Password Generator

1. 01Set the lengthLonger is the single biggest factor. Sixteen characters is a sensible floor for anything that matters.
2. 02Choose character typesLowercase, uppercase, digits and symbols. Some systems reject symbols, which is why each is a separate switch.
3. 03Copy it into your password managerGenerate a new one any time. Nothing is remembered between reloads.

• A new account you will never type by handMaximum length, every character type on. You are storing it in a manager, so readability does not matter.
• A password someone has to read out or retypeTurn on the look-alike exclusion. It removes the characters that cause the "was that a one or an l?" phone call.
• A system with awkward rulesPlenty of older systems reject symbols or cap the length. Turn symbols off and set the length to whatever the field accepts.

• Length beats complexityAdding characters to a password increases the work of guessing it far faster than adding exotic symbols to a short one. A long password from a smaller character set is generally a better trade than a short one with every symbol type.
• Why look-alikes are excludedIn most fonts 0 and O, and 1, l and I, are nearly identical. If a password will be read from a screen, written on paper or dictated, excluding them removes a whole class of failed logins.

• A unique password per account is the pointReuse is what turns one site's breach into every account you own. Generating is easy; the manager that stores them is what makes it workable.
• The strength label is a guide, not a guaranteeIt reflects length and the character set in use. It cannot know whether you later wrote the password on a sticky note.

The password is built from the browser's cryptographic random number generator, which is designed to be unpredictable even to someone who knows every other value it has produced. This matters because the obvious alternative, the general-purpose random function built into JavaScript, is not designed for secrecy: it is fast and statistically even, but its output can be predicted from previous values. For a dice-roll simulation that is fine. For a password it is not, and the distinction is invisible in the result — both produce something that looks random.

The number of possible passwords grows with the size of the character set raised to the power of the length. Because length is the exponent, adding characters compounds far harder than widening the alphabet. Going from eight characters to sixteen is a vastly larger change than adding symbols to an eight-character password. This is why the practical advice is the dull one: make it long, store it in a manager, and do not try to make it memorable — a password you can remember is drawn from a much smaller space than one you cannot.

Generation happens entirely on your device. There is no request carrying the password anywhere, no server that sees it and nothing written to storage, so closing the tab genuinely discards it. That is the property you want from a password tool, and it is worth checking for on any site that offers one: a generator that produces its output server-side has, by definition, transmitted your password before you ever see it.

How long should a password be?

Sixteen characters or more for anything that matters, and as long as the field allows for accounts you will never type by hand. Length helps more than any other single choice.

Is the password sent to a server?

No. It is generated in your browser using the cryptographic random generator and never transmitted or stored.

Why would I exclude look-alike characters?

Because 0 and O, and 1, l and I, are hard to tell apart in most fonts. If the password will be read aloud, typed from a screen or written down, excluding them prevents a lot of failed attempts.

Are these passwords stored or reused?

Never. Nothing is kept between reloads, and each generation is independent of every previous one.