Password Generator

Strong random passwords made in your browser.

Multi-factor authentication blocks the great majority of automated account attacks, and a password manager removes the pressure to memorise anything. Entropy measures how many guesses an attacker needs, not how unusual the password looks.

Password strength is entropy: a random 12-character password from 94 symbols carries about 78 bits, far beyond any realistic brute-force attempt, while a memorable phrase of the same length falls to dictionary guessing. Reusing one strong password across sites remains the larger practical risk.

Credential guidance in the United States follows NIST: length beats symbol complexity, forced rotation is out, and a second factor matters more than a clever password. Breach data shows reused credentials behind most account takeovers, since one leaked database unlocks every site sharing that password.

Strength is measured in bits of entropy — every extra character multiplies the search space, which is why length buys security faster than punctuation does.

Length buys entropy faster than complexity does, and a passphrase of four random words can outperform a short string of substituted characters. Credential stuffing, not brute force, is the attack that reuses one leaked password across many accounts.

Password Generator sits with the rest of the library's everyday work, and it rests on the same account-security arithmetic the way a manufacturer's label or a timetable does. Its answer is only as good as the assumptions standing behind it.

Everyday arithmetic in the United States carries conventions that are easy to miss: dates run month before day, distances and weights follow customary units, and prices are quoted before tax. Those conventions make a surprising share of daily sums come out differently from the same question asked elsewhere.

The figures in this section follow American practice unless the subject itself is international.