🔐

Random Password Generator

Why random beats “clever” passwords

Humans pick patterns: seasons, pet names, keyboard walks like qwerty123. Attackers compile billions of these into cracking dictionaries. A 16-character random password from four character classes has far more combinations than any phrase you invent under stress.

NIST SP 800-63B no longer tells users to rotate passwords on a calendar for no reason — it stresses length and breach checks instead. For new accounts, aim for at least 14 characters when the site allows it; 20+ for email, banking, and password-manager master passwords.

What this tool actually does

When you click Generate, the tool picks random bytes, maps them to your chosen character sets, and guarantees at least one character from each enabled type (so you never get “letters only” by accident). Symbols use a practical set such as !@#$%^&* unless you narrow the pool.

Bulk mode creates multiple independent passwords — useful for onboarding test users, not for reusing one password everywhere. Copy once, paste into your password manager, then clear the clipboard on shared machines.

• Passphrase mode: word lists with separators — easier to type on TV remotes, still long.
• Exclude ambiguous: drops 0/O and 1/l/I if you must read passwords from paper.
• Strength meter: estimates crack time; treat it as guidance, not a guarantee.

After you generate: do this, not that

Do store the password in a reputable password manager (Bitwarden, 1Password, KeePass, etc.). Do enable MFA on the account. Do not screenshot passwords to cloud albums, email them to yourself, or reuse the same string on “low risk” forums — credential stuffing connects those dots.

If a site caps length at 8 or blocks symbols, use the longest allowed string and register a unique email alias where possible. Weak site policy is their fault; your job is not to compensate with a memorable short password.