About the Password Generator
Creates random passwords using your browser's cryptographic random number generator - not Math.random, which is predictable. Ambiguous characters like l, I, 1, O and 0 are excluded by default so a written-down password does not get mistyped.
What makes a password strong
Length matters more than anything else. Every extra character multiplies the number of guesses an attacker needs, so a 20-character random password is far stronger than a 10-character one full of symbols. Mixing lowercase, uppercase, numbers and symbols widens each character's range, which helps too. The strength meter estimates how long the password would resist guessing.
Good password habits
- Use a different password for every account - reuse is how one leak becomes ten.
- Store them in a password manager rather than a note or a spreadsheet.
- Turn on two-factor authentication wherever it is offered.
- Some sites reject certain symbols; untick symbols and add a few characters of length instead.
Passwords are generated in your browser with the operating system's cryptographic random number generator and are never sent or stored. Building something that stores passwords? Hash them with a slow algorithm - see the hash generator for why plain SHA-256 is not enough.
