How to Create a Strong Password (And Why It Matters)
Most password advice is a decade out of date, and some of it made things worse. The short version: length matters far more than complexity, and reuse is the risk that actually gets people. The Password Generator produces random passwords at whatever length and character mix you choose.
Length beats complexity
Every character you add multiplies the number of possibilities. Adding a symbol to an eight-character password helps a little; making it sixteen characters helps enormously.
The reason is that attackers do not guess character by character against a login form. They work offline against a stolen database of password hashes, at enormous speed, and they start with dictionaries, leaked password lists and the predictable substitutions people make. A password that follows a human pattern falls quickly however many symbols it contains, and a long random one does not fall at all.
This is why the old rules misfired. Demanding one uppercase, one number and one symbol produced Password1! across the entire internet - technically compliant and among the first things any cracking tool tries. The substitution tricks are no better: replacing an a with an @ or an s with a 5 is in every dictionary attack ever written.
Reuse is the real problem
A strong password used on twenty sites is as weak as the worst-run of those twenty. When one is breached - and one will be - the attacker has your email address and a working password, and the first thing they try is your email account, because that is where every password reset goes.
So every account needs its own password, which means nobody can remember them, which means a password manager. That is the actual answer, and it is more important than any rule about characters. Generate a long random password per site and let software remember it.
Where a strong password is not enough
Turn on two-factor authentication wherever it is offered, especially on email and anything financial. A password is something you know and can be stolen without you noticing; a second factor means a stolen password alone is not enough.
And be honest about which accounts matter. Your email, your bank and your password manager are the ones worth real care - everything else can be recovered from them.
Common questions
Are passphrases as good as random strings?
Four or five random, unrelated words make a strong and memorable password. The catch is that they must be genuinely random - a phrase you chose because it means something to you is far weaker.
How long should a password be?
Sixteen characters or more if software is remembering it. If you must type it from memory, use a long passphrase rather than a short complex string.
Should I change passwords regularly?
Not on a schedule - that pushes people into predictable variations. Change one immediately if a service reports a breach.
Is my generated password sent anywhere?
No. It is produced in your browser using the browser's own cryptographic randomness.
Need one you have not used anywhere else?