Most password advice pulls in two opposite directions. Security experts want long, random strings, while normal people need something they can type from memory without opening a password manager every time. This guide walks through a practical middle ground, and shows exactly how to set up the free Password Generator for each kind of account.
Why "Password123" Fails in Seconds
Short passwords built from common words, names or predictable number patterns are easy for automated cracking tools to guess. Those tools test known common passwords and simple variations first, not random combinations. Birthdates, names and sequences like "123456" are cracked almost instantly, and even clever-feeling tricks such as swapping letters for similar-looking numbers are well known to attackers.
What Makes a Password Strong
A strong password is long, unpredictable and free of obvious patterns. Length matters more than complexity alone. A 14-character password is generally much harder to crack than an 8-character one, even when the shorter one has symbols mixed in.
Why Length Beats Complexity
Every extra character multiplies the number of combinations an attacker has to try. That is why a long passphrase made of unrelated words is often both stronger and easier to remember than a short string crammed with symbols and substitutions.
The Passphrase Approach
Instead of one hard-to-remember word with a few symbols swapped in, string together three or four unrelated words that mean something specific to you but would not appear together in any dictionary or common phrase. The randomness of the combination provides the security, not the individual words. The result is usually memorable and still long enough to resist common cracking methods.
Why Reusing a Password Is the Bigger Risk
Attackers use a technique called credential stuffing. They take an email and password leaked from one website and try the same login on many other sites, hoping it works elsewhere. If you reuse a password, one breach on a small forum can open your email, your banking and your social accounts together.
A unique password on your most important accounts matters more than making every password elaborate. Start with your email, your banking and any account that can reset the passwords of others.
How to Use the Password Generator
The Password Generator lets you control the result instead of accepting a fixed format. Here is what each setting does.
- Length slider: choose any length from 6 to 64 characters. It starts at 12. For important accounts, move it up to 16 or more.
- Character types: uppercase letters, lowercase letters, numbers and symbols. Uppercase, lowercase and numbers are on by default. Symbols start off, so switch them on for stronger passwords.
- Pronounceable mode: makes a password that is easier to read and type. It is handy for a password you must enter by hand, but pronounceable passwords generally have less randomness than fully random ones, so make them longer.
- Exclude similar characters: on by default. It avoids characters that are easy to confuse when you read them off a screen or a note.
- Exclude ambiguous symbols: useful when a website or a person has trouble with certain symbols.
- Auto-regenerate on change: on by default. A new password appears as soon as you change a setting, so you can experiment freely.
- Bulk generate: create 1 to 20 passwords at once, with 5 as the default. Useful when you are updating several accounts in one sitting.
How the Generator Creates Passwords
The Password Generator picks characters with window.crypto.getRandomValues(), the random number source built into your browser and designed for security use. It does not use the simpler Math.random(), which is not meant for passwords.
Which Settings for Which Account?
- Email, banking and social media: length 16 or more, uppercase, lowercase, numbers and symbols on. Save it in a password manager so you never type it.
- A website that rejects symbols: turn symbols off and raise the length to 20 or more to make up for it.
- A password you must type by hand, such as a shared Wi-Fi or a device you log in to often: try Pronounceable mode with a longer length, or use a passphrase.
- Changing many old passwords: use bulk generate, then update your most important accounts first.
Where a Password Generator Fits In
For accounts where you do not need to type the password from memory, because it is saved in a password manager or autofilled by your browser, a fully random generated password is the strongest option. There is no memorability trade-off to worry about. Reserve memorable passphrases for the handful of accounts you genuinely have to type, such as your device lock screen or a shared login.
A Simple System to Actually Follow
- Use a password manager. Many browsers include one built in.
- Generate a unique random password for every account you do not type by hand.
- Use a passphrase of unrelated words for the few accounts you must remember.
- Treat any password reused on more than one important account as a gap to fix today, however strong it looks.
Frequently Asked Questions
How long should a strong password be?
At least 12 to 14 characters is generally recommended against modern cracking methods. For email and banking, 16 or more is a safer choice.
Are randomly generated passwords safer than ones I create myself?
Yes. People tend to create predictable patterns even when they try to be random, and a generator removes that bias.
Do I need a different password for every account?
Ideally yes, especially for email, banking and social media. A unique password stops one breach from spreading to your other accounts.
Is it safe to store passwords in a browser?
Browser password managers offer reasonable convenience and security for most users.
What length can the generator make?
From 6 to 64 characters. It starts at 12, and you can move the slider to suit the account.
Why are symbols off by default?
Some websites do not accept symbols. You can switch them on for any account that allows them, which gives a stronger password at the same length.
Can I generate more than one password at a time?
Yes. Bulk generate creates 1 to 20 passwords at once.