What actually makes a password hard to crack
Password strength comes down to how many possible combinations an attacker would need to try before guessing correctly, a property called entropy. Every additional character multiplies the number of possible combinations, which is why length matters more than most people expect: a long password made of random characters is dramatically harder to brute-force than a short one, even if the short one mixes in symbols and numbers.
This is also why reusing a memorable pattern (a word plus a number plus a symbol) is weaker than it looks. Attackers' cracking tools are specifically built around common patterns like that, so "complexity that follows a predictable structure" doesn't add nearly as much real protection as true randomness does.
How this generator creates a random password
This tool uses your browser's cryptographically secure random number generator (the Web Crypto API's getRandomValues), the same class of randomness used for actual cryptographic operations, not a simple pseudo-random function that could theoretically be predicted. Each character is selected independently and uniformly from the character sets you've enabled (lowercase, uppercase, numbers, symbols), so there's no exploitable pattern in the result.
Adjust the length slider and the character-set checkboxes to match what a given site or system requires, then generate as many candidates as you like. Each one is freshly random, with no relationship to the previous one.
How to use this tool
- Set your desired password length using the slider. Longer is stronger, and 16+ characters is a reasonable default when a site doesn't impose a stricter limit.
- Choose which character types to include: lowercase, uppercase, numbers, and symbols. Including all four maximizes the character pool, which increases strength for a given length.
- Click Generate new to produce a fresh password, or keep clicking until you get one that satisfies any specific requirements a site has (like requiring at least one symbol).
- Copy the result directly to your clipboard.
Generation happens entirely client-side. The password is never transmitted anywhere, and closing the tab clears it from memory.
What to actually do with the password afterward
A randomly generated password is only as useful as your ability to keep track of it without weakening it. Writing it on a sticky note or reusing it across multiple accounts defeats the purpose. The standard practice is to store generated passwords in a dedicated password manager, which remembers them so you don't have to, and can auto-fill them when needed.
If a password manager isn't an option, the next best approach is generating a unique password per site rather than reusing one anywhere. A single leaked password from one breached site is far less damaging if it isn't also the password protecting your email or banking.