| Scenario | Recommended length | Strength guide |
|---|---|---|
| Regular website accounts | 12+ chars | Upper + lower + digits |
| Email / cloud storage | 16+ chars | All four types |
| Payments / servers | 20+ chars | All four types + regular rotation |
"123456", "qwerty" and "birthday + phone number" perennially top the weakest-password lists — credential stuffing and brute force crack them in seconds. Secure passwords need enough length and randomness, and human "random" choices tend to follow patterns.
This tool generates passwords with the browser's cryptographic random source (crypto.getRandomValues), with customizable length (6–64 characters) and character types, options to exclude confusable characters like 0/O and 1/l/I, and a live strength estimate (entropy bits). Everything runs locally in your browser — no network, no uploads, no storage.