Password Generator

How these passwords are generated

Choose a length between 4 and 128 characters, tick the character classes you want — lowercase, uppercase, digits, symbols — and generate up to 50 passwords at once. Every character is drawn from a cryptographically secure random source, the same class of generator used for session tokens and encryption keys, not from a general-purpose random function seeded by the clock.

That distinction is the whole point. A password produced by a weakly seeded generator can be reconstructed by anyone who knows roughly when it was created, no matter how complex it looks. Randomness that is merely unpredictable to a human is not the same as randomness that is unpredictable to an attacker with a computer.

The generator also guarantees at least one character from every class you selected. Without that guarantee, a short password can come out with no digit at all purely by chance and then fail the very policy you generated it for.

Length beats complexity

The instinct to add symbols and swap letters for lookalikes is largely misplaced. What actually determines how hard a password is to crack is entropy, and entropy grows far faster with length than with character variety.

A 12-character password using lowercase, uppercase and digits has roughly 71 bits of entropy. Adding symbols to that same 12 characters buys about 7 more bits. Extending it to 16 characters instead buys about 24. Length is simply the cheaper purchase, and it is easier to handle.

This matters because modern password cracking is not a person guessing. It is hardware testing billions of candidates per second against a leaked hash. Substitutions like a-for-@ and 3-for-e have been in every cracking dictionary for two decades and add essentially nothing. A 16-character random password is out of reach of that hardware; a clever 8-character one is not.

Choosing a length

Sensible defaults, assuming the password is genuinely random rather than something you invented:

• 16 characters — a good default for ordinary accounts. Comfortably beyond brute force, and short enough to type on the rare occasion you must.
• 20 to 24 characters — for email, banking, cloud infrastructure, and your password manager's own master password. Your email account deserves the strongest one you have, because it is the reset path for everything else.
• 32 or more — for API keys, service credentials, and anything a machine will handle. There is no cost to length when nothing has to type it.
• Under 12 — only where a system refuses longer input. Some banks still cap at 8 to 12 characters, which is their failing rather than yours; use the maximum they allow and enable two-factor authentication.

A generated password only helps if you never reuse it

The dominant way accounts are compromised today is not cracking — it is credential stuffing. A breach at one site exposes an email and password, and attackers replay that pair against hundreds of other services. Billions of such pairs are already circulating. Reusing one perfect password everywhere means a single breach anywhere unlocks everything.

The practical answer is a password manager, which makes a unique random password per site the path of least resistance. Then add two-factor authentication on anything that supports it, preferring an authenticator app or hardware key over SMS, since SMS can be intercepted through SIM swapping. A unique password plus a second factor defeats credential stuffing outright, even for a password that later leaks.

Privacy

Passwords are generated to build the response and are never stored, logged, or reused between visitors. Each one is drawn fresh at the moment you ask for it. As a matter of general hygiene, move a generated password straight into your password manager rather than leaving it sitting in a browser tab or pasting it through a chat window.