Which password mode should you use?
Random Password is the strongest option for accounts where you use a password manager. Enable all character types and use at least 16 characters. A 16-character random password with uppercase, lowercase, numbers, and symbols has more possible combinations than there are atoms in the observable universe, making it effectively impossible to brute-force.
Passphrase is better when you need a password you can actually type and remember, such as for your computer login or password manager master password. A four-word passphrase like River-Cloud-Ember-Stone is far easier to remember than a random string and is still extremely secure. Adding a number increases the strength further.
Custom Words is useful when you want a password based on something meaningful to you. The tool transforms your words using leet substitutions (replacing letters with similar-looking numbers and symbols), shuffles the order, and appends a random number and symbol. This turns a simple phrase into something an attacker could not guess.
Password security best practices
Use a different password for every account. If one site is breached, attackers will try that password on every other service you use. A password manager handles this automatically by storing and filling unique passwords for each site.
Enable two-factor authentication wherever it is available. Even if your password is stolen, an attacker cannot log in without the second factor from your phone or authenticator app.
Longer passwords are stronger than complex short ones. A 20-character password with only lowercase letters has more combinations than a 10-character password using all character types.
Frequently asked questions
- Are generated passwords stored or sent anywhere?
- No. Every password is generated entirely inside your browser using JavaScript. Nothing is transmitted to any server. Close the tab and the password is gone.
- Is the random generation truly random?
- Yes. The generator uses
crypto.getRandomValues(), the cryptographically secure random number generator built into your browser. This is the same source of randomness used by security software. - How long should a password be?
- For accounts stored in a password manager, 16 to 20 characters is standard. For passwords you need to memorize, a 4 to 5 word passphrase is easier to remember while still being very secure. Never use a password shorter than 12 characters for important accounts.
- What are leet substitutions?
- Leet substitutions replace letters with visually similar characters: a becomes @, e becomes 3, i becomes !, o becomes 0, and so on. This transforms a recognizable word into something that passes most character-type requirements while remaining somewhat memorable.