Strong Password Generator — Random, Secure, Private

What makes a password strong

A strong password is one an attacker cannot guess, even with a fast computer and a list of every password ever leaked. That rules out anything a person chooses: names, dates, dictionary words and clever substitutions like “P@ssw0rd” all appear in cracking lists. The only reliable way to create a password nobody can predict is to let a proper random generator choose it.

How this generator works

Characters are picked with crypto.getRandomValues, the cryptographically secure random number generator built into every modern browser — not the ordinary Math.random, which was never designed to be unpredictable. Each character is chosen with rejection sampling, so every character in the set is exactly as likely as every other. When you tick a character type, the password is guaranteed to contain at least one character of that type.

Length versus complexity

• 12 characters, all types — about 78 bits. Fine for low-value accounts.
• 16 characters, all types — about 104 bits. A good default for anything important.
• 20 characters, all types — about 130 bits. For email, banking and your password manager.
• 20 characters, letters only — still about 114 bits. When a site rejects symbols, add length instead.

Habits that matter more than the password

• Never reuse a password. When one site is breached, attackers try the same email and password everywhere else — it's called credential stuffing, and it's how most accounts are taken over.
• Use a password manager so a unique password per site costs you no effort.
• Turn on two-factor authentication for email, banking and social accounts. A stolen password alone then isn't enough.
• Change a password when a service reports a breach, not on a fixed schedule — forced regular changes tend to produce weaker, predictable passwords.