Why generated passwords beat invented ones
People are predictable. The passwords we invent lean on names, dates, and keyboard patterns, and attackers know it — their software tries those first. A password generated from your browser's cryptographic random source has no such pattern, so the only way to break it is to try every possibility. That's why length and randomness matter far more than swapping an a for an @. A long random string you store in a password manager is dramatically harder to guess than a clever-looking one you can memorise.
How to use it
- Set the length — 16 characters or more is a sensible default for important accounts.
- Choose which character types to include: uppercase, lowercase, numbers, and symbols.
- Generate, then copy the result straight into your password manager and the site's sign-up field.
- Never reuse it. A unique password per account means one leak can't unlock the others.
Picking good settings
- Longer is better: each extra character multiplies the number of combinations.
- Include symbols where the site allows them; some older sites reject certain characters, so keep a fallback.
- For passphrases you must type by hand, favour length over exotic symbols.
Questions people ask
Is the password sent anywhere? No. It's generated in your browser using the Web Crypto API and never transmitted. Closing the tab discards it.
Are these truly random? They come from crypto.getRandomValues, the same cryptographically secure source browsers use for security features — not the weaker Math.random.
Should I memorise it? No — that pushes you toward shorter, weaker choices. Let a password manager remember it and protect that with one strong master password.