Password Generator

Why do you need a strong password?

In 2025, more than 24 billion username/password combinations were leaked in data breaches worldwide. Weak passwords are the number one cause of hacked accounts. A strong, unique password for every account is your first line of defense against cyberattacks.

The most common attack methods against passwords are:

• Brute force: a computer systematically tries every possible combination. A password of 8 lowercase letters (26⁸) has only 209 billion possibilities and can be cracked in minutes. With 16 characters and all character types, this becomes infeasible.
• Dictionary attacks: attackers use dictionaries of common passwords, words and patterns. “Welcome123” and “Summer2025!” are on every attack list.
• Credential stuffing: leaked combinations from one service are automatically tried on other services. Do you reuse the same password? Then one leak gives access to all your accounts.
• Password spraying: common passwords are tried against thousands of accounts at once. “Welcome1”, “Password1!” and “Company2025” are favorites.

How long should a password be?

The strength of a password is determined by its entropy: the mathematical measure of unpredictability, expressed in bits. The more bits of entropy, the harder the password is to guess.

Entropy is calculated as: log₂(charset_size) × length

Recommendation: use at least 12 characters with all character types (uppercase letters, lowercase letters, numbers and symbols). For important accounts such as your email, bank and hosting, use 16 characters or more. The default setting of our generator (16 characters, all character types) gives 101 bits of entropy, which is more than enough for any use.

Tips for managing passwords securely

Generating a strong password is only the first step. How you manage your passwords is at least as important:

1. Use a password manager

A password manager stores all your passwords securely encrypted behind one strong master password. Popular options are:

• 1Password: excellent interface, for business and personal use
• Bitwarden: open source, free basic version
• KeePass: fully offline, open source

2. Use a unique password for every account

Reusing passwords is the biggest risk. If one service gets hacked and you use the same password elsewhere, attackers immediately have access to all those accounts. With a password manager it is easy to use a unique password everywhere.

3. Turn on two-factor authentication (2FA)

2FA adds an extra layer of security on top of your password. Even if your password has leaked, an attacker also needs your phone or security key. Preferably use an authenticator app (Google Authenticator, Authy) instead of SMS.

4. Check regularly for data breaches

Services such as HaveIBeenPwned check whether your email address appears in known data breaches. If it does, change your password for that service right away, and everywhere else you used the same password.

Common password mistakes

Avoid these common mistakes that leave your accounts vulnerable:

• Using personal information: names of pets, birthdays, street names and other personal details are easy to find through social media.
• Common patterns: “Welcome123”, “Password!”, “Qwerty2025” and variations are on every attack list.
• Simple substitutions: replacing ‘a’ with ‘@’ or ‘e’ with ‘3’ (leet speak) is a well-known pattern that attackers include automatically.
• Passwords that are too short: even with all character types, a password of 6-8 characters can be cracked in hours or days with modern hardware.
• Writing passwords down: on sticky notes by your monitor, in unencrypted note apps or in emails. Always use an encrypted password manager.
• Sharing passwords over insecure channels: email, chat and SMS are not secure. Use the sharing feature of your password manager.

How does our password generator work?

Our password generator uses the Web Crypto API (crypto.getRandomValues()), a built-in browser function that generates cryptographically secure random numbers. This is the same technology that banks and security software use.

The process works like this:

1. You select the character types and length you want
2. The browser generates a series of cryptographically random numbers
3. Each number is converted to a character from the selected character set
4. The password is checked to contain at least one character from each selected group
5. The entropy is calculated and shown visually

Important: nothing is sent to our server. The entire process takes place in your browser. You can verify this by using the page offline (after the first load): the generator keeps working.