About the Password Generator
Password strength is a question about the process that generated the password, not about the characters in it. A password is strong when an attacker who knows exactly how it was made still faces too many possibilities to search. That means the only quantity that matters is entropy: the number of equally likely outcomes the generator could have produced.
This generator uses the browser's cryptographic random source rather than a general-purpose pseudo-random function, and everything is produced locally — nothing is transmitted, logged, or stored.
Substitution rules like replacing letters with lookalike digits add essentially nothing, because password-cracking tools have applied those same rules for decades. Length is what actually moves the number, since every additional character multiplies the search space.
Frequently asked questions
How long should a password be?
For anything protected by a well-implemented server-side hash, sixteen random characters is comfortable. For something guessed offline against a leaked hash — a password manager master password, a disk encryption key — go longer, or use a passphrase of five or six random words, which reaches similar entropy while remaining typeable.
Are random characters better than a passphrase?
Per character, yes; per unit of human effort, no. A word chosen randomly from a list of several thousand contributes far more entropy than a single character, so a six-word passphrase is both stronger and easier to type than a twelve-character jumble. The critical word is random — a phrase you invented yourself is guessable in a way a dice-selected one is not.
Does adding symbols make a password meaningfully stronger?
Less than length does. Adding symbols widens the alphabet from about 62 to roughly 95, which is worth about half a bit per character. Adding four more characters is worth far more. Symbols mainly help by defeating attacks that assume a restricted alphabet — but composition rules that force one symbol tend to produce an exclamation mark at the end, which attackers assume anyway.
Should passwords be rotated regularly?
Not on a schedule, for user passwords. Both NIST and the UK NCSC now advise against forced periodic rotation, because it drives predictable increments and reuse, which are worse than a stable strong password. Rotate on evidence of compromise. Machine credentials and API keys are a different case, where short automated lifetimes are genuinely valuable.
Is generating a password in the browser safe?
It depends on the source of randomness. This tool uses the platform cryptographic random API, which is designed for key material; a generator built on a general-purpose pseudo-random function is predictable from a small amount of output and unsuitable. The value never leaves the page, but a browser is still a shared environment — for a high-value credential, generate it in your password manager.
Need this managed for you, not just automated?
We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.