How to Generate Strong Passwords (That You Can Actually Use)

The short version: use a generator to make long, random passwords (16+ characters), never reuse them, and store them in a password manager. Your memory is not a security system.

Every year, the most common passwords are still things like "123456" and "password." Every year, billions of credentials leak from breaches. The gap between those two facts is where accounts get taken over — and the fix is boring, simple, and free.

What actually makes a password strong

Two things, in order of importance:

1. Length. Every extra character multiplies the guessing work exponentially. A 16-character random password is roughly 95 trillion times harder to brute-force than an 8-character one. Length is the single biggest lever you have.

2. Randomness. Human "random" isn't random — we pick patterns, words, substitutions (P@ssw0rd!), and keyboard walks. Attackers know all of these patterns and try them first. True randomness means every character is independent of the last, which is what a generator gives you.

Character variety (uppercase, lowercase, numbers, symbols) helps by expanding the pool each position is drawn from — but a long password from a smaller pool beats a short one from a bigger pool. When in doubt, add length.

Generate one properly

The free password generator is built on the right foundations:

• Cryptographically secure randomness via the Web Crypto API (crypto.getRandomValues) — the same grade of randomness browsers use for their own security features. Not Math.random(), which is predictable.
• Adjustable length, defaulting to 18 characters.
• Character options: uppercase, lowercase, numbers, and symbols — toggle each independently, with a guarantee that each enabled type actually appears.
• Exclude ambiguous characters — drops lookalikes like O, 0, l, 1, and I for passwords you might need to read or type.
• Entropy readout — it shows the password's strength in bits of entropy with a plain rating, so you can see exactly what you're getting.
• 100% local. The password is generated in your device's memory and never sent anywhere. Copy it, use it, done.

Generate, copy, paste into the account, save it in your manager. The whole flow takes thirty seconds.

How attackers actually crack passwords

Understanding the threat makes the advice click. Attackers don't sit guessing one by one — they work in layers:

1. The breached list. Billions of username/password pairs from past breaches circulate freely. Attackers try them verbatim first. If your password was ever in a breach and you reused it, you're already compromised — check your addresses on a breach-notification service.

2. The dictionary with mutations. "Password," "qwerty," "letmein" — plus automated mutations: capitalizing the first letter, appending "123" or "!", leetspeak substitutions. Every "clever" human pattern is in the mutation engine. P@ssw0rd! falls in milliseconds.

3. Credential stuffing. Leaked credentials from Site A are automatically tried on Sites B through Z. This is fully automated and industrialized — and it's the attack that unique passwords per site completely defeats.

4. Brute force. Trying every combination. This is where length wins: each added character multiplies the search space. A 12-character random password is already beyond practical brute force; 16+ is beyond theoretical concern for the foreseeable future.

5. Phishing and social engineering. No password survives a fake login page. This is why 2FA matters — it's the defense for the attack passwords can't stop.

Notice what's missing: nobody is "hacking the mainframe." Account takeover is overwhelmingly a game of reused, breached, and guessable passwords — exactly what a generator plus a manager eliminates.

The rules that actually matter

Never reuse passwords. This is the big one. Breaches are routine; attackers automatically try leaked credentials on thousands of sites (credential stuffing). A unique password per site means one breach stays one breach.

Your email password is the most important one. Email is the reset mechanism for everything else. If someone owns your email, they own your password resets. Give it your longest, strongest password and turn on two-factor authentication.

Two-factor authentication (2FA) everywhere it matters. A strong password plus a second factor (authenticator app, security key) means a leaked password alone isn't enough. Start with email, banking, and cloud storage.

Don't use personal information. Birthdays, pet names, addresses, favorite teams — all guessable, all findable on social media. Random strings have no connection to you to exploit.

Change passwords after breaches, not on a schedule. Forced 90-day rotations produce weaker passwords (Password1! → Password2!). Change when there's a reason: a breach notification, a shared computer, a password you typed somewhere sketchy.

What about passphrases?

A passphrase — four or five random words like correct horse battery staple — is genuinely strong if the words are random. The problem is human-picked passphrases aren't random ("iloveyou sunshine coffee" is not security). If you want memorable, use a generator's passphrase mode or diceware with real dice; if you want maximum strength per character, use the random-character generator. Either way, randomness is the requirement, memorability is the bonus.

Storing them: the part people skip

A strong password you can't retrieve is a locked account. You have three sane options:

1. A password manager — encrypted vault, one master password, autofill. The best option for almost everyone. (More on this in our password manager vs. generator guide.)
2. Your browser's built-in manager — decent, synced, better than nothing.
3. Written down, kept safe — genuinely fine for a handful of critical passwords. A notebook in a drawer beats reuse.

What doesn't work: the same three passwords rotated across everything, the notes app on your phone, or "I'll remember it" for 40 accounts.

The 10-minute security upgrade

Right now, in ten minutes: generate a new 20-character password for your email, enable 2FA on it, and install a password manager. Then, whenever you log into anything else this week, take the extra minute to generate and save a unique password for it. In a month, you'll be most of the way to unique passwords everywhere — starting from the account that matters most.

Generate a strong password — it takes less time than reading this sentence did.