Strong Password Generator

How to use the Strong Password Generator

1. Set the length with the slider. Sixteen characters is a sensible default for most accounts; go longer for anything that guards money or email.
2. Tick the character groups you want: uppercase, lowercase, numbers and symbols. Some older systems reject symbols, so untick that group if a site keeps refusing the result.
3. Press Regenerate until you get one you are happy with, then Copy to Clipboard and paste it into the site or your password manager.

When to use it

Reach for this when you are creating a new account, rotating a password after a breach notice, or setting up a shared login for a supplier portal. A random string of mixed characters is far harder to guess or brute-force than a word with a number tacked on, and because every password here is generated fresh, no two accounts end up sharing one.

What makes the result strong

Strength is a function of length and the size of the character set, not of how random the password looks. With all four groups on, each character is drawn from about 94 possibilities; 16 of them give roughly 2^105 combinations, which no current attacker can search. Drop symbols and numbers and the set shrinks to 52 letters, so the same 16 characters are about 2^91: still far beyond brute force, which is why length matters more than symbols. The generator draws each character from the browser's cryptographic random source, and the password exists only on your screen and, after Copy, on your clipboard.

Worked example

A new supplier portal: 16 characters, all groups, one click, copy, paste into the portal and into the password manager. A legacy accounting system that refuses symbols: untick Symbols, raise the length to 20 to compensate, regenerate. A Wi-Fi password that staff will type on phones: uppercase, lowercase and numbers only, 14 characters, so nobody has to hunt for a caret on a phone keyboard. The three passwords are unrelated to each other, which is the point.

Common mistakes

• Regenerating until it "looks nice". A password you can remember is one an attacker can guess. Store it instead.
• Reusing one strong password. One breach then opens every account. One password per account, kept in a manager.
• Sending it in the same message as the username. Separate channels, or a one-time link.
• Leaving it on the clipboard. Copy something else after pasting; clipboard managers keep history.

When this tool is the wrong one

It makes passwords, not passphrases (several random words, easier to type by hand) and not recovery codes. It does not store anything, so it is not a password manager; use one. For any account that offers two-factor authentication, turn it on: a strong password is the floor, not the ceiling.

Good to know

The password is generated by your browser's own cryptographic random number generator and is never sent anywhere, so there is nothing for us, or anyone else, to log. Store it in a password manager rather than a notes app, and never reuse it across services.