A generated password is stronger than an invented one for a reason that has nothing to do with cleverness: human-chosen passwords cluster. We pick words, we substitute 3 for e, we append a year and an exclamation mark, and attackers have known these patterns for two decades. Their cracking tools test the transformations first.
What actually resists attack is entropy — the number of possibilities an attacker must work through. Entropy comes from length and unpredictability, and length does more work than complexity.
Length beats complexity
| Password | Length | Character set | Resistance |
|---|---|---|---|
| Tr0ub4dor&3 | 11 | Mixed | Weak — a known pattern |
| P@ssw0rd123 | 11 | Mixed | Trivial — top of every wordlist |
| correct horse battery staple | 28 | Lowercase + spaces | Strong |
| xK9#mQ2$vL8@ | 12 | Full | Strong |
| 16+ random characters | 16+ | Full | Beyond current brute force |
Practical rules
- Sixteen characters or more wherever the site allows it. Length is the single highest-value variable.
- A different password for every account — reuse is what turns one breach into ten.
- Use a password manager. It is the only realistic way to hold dozens of unique passwords, and it also defeats phishing by refusing to autofill on the wrong domain.
- Turn on two-factor authentication. It protects the account even when the password is already compromised.
- Prefer an authenticator app or a hardware key over SMS, which is vulnerable to SIM swapping.
Advice that has been withdrawn
NIST guidance now recommends against forced periodic password changes and against mandatory character-composition rules. Both were found to make security worse in practice: forced rotation produces predictable increments like Spring2024 followed by Summer2024, and composition rules push people toward the same handful of substitution patterns. The current recommendation is a long password, changed only when there is reason to believe it has been exposed.
How this generator works
Passwords are generated locally in your browser using its cryptographic random source. Nothing is transmitted, nothing is logged, and no generated password ever leaves your device — closing the tab is enough to destroy it. That said, the strongest habit is to let a password manager generate and store credentials directly, so the password never passes through a clipboard at all.