Secure Password Generator

There are two sound ways to build a strong credential, and the right one depends on whether you will ever have to type it from memory:

• Random characters (what this tool generates): each character drawn from a 94-symbol set adds log₂(94) ≈ 6.55 bits of entropy. A 16-character password is ≈ 105 bits — far beyond any realistic brute-force attack.
• Random-word passphrases (Diceware style): each word drawn from the EFF long wordlist of 7,776 words adds log₂(7776) ≈ 12.9 bits. Five words ("maple-vivid-crater-onion-jukebox") is ≈ 64 bits — strong enough for a master password, and dramatically easier to memorise and type on a phone keyboard.

The rule of thumb: passwords you store in a manager should be random characters; the one password you must remember (the manager's master password) should be a 5–6 word passphrase. The words must come from a random source like dice or a generator — words you pick yourself ("correct horse" chosen by a human) cluster around common vocabulary and are much weaker than the maths suggests.

Understanding the two attack modes explains why the advice above works:

• Online guessing — trying passwords against the login form. Any competent site throttles this to a handful of attempts, so even weak passwords survive. This is why attackers rarely bother.
• Offline cracking — the dangerous one. After a data breach leaks a site's password hashes, attackers test guesses on their own hardware at billions of attempts per second. They don't guess randomly: they run leaked-password lists, dictionary words with common substitutions (p@ssw0rd), keyboard walks (qwerty123), and dates first. Human-invented passwords fall in seconds because they live in exactly those lists.

A truly random 16-character password isn't in any list and sits in a search space of 94¹⁶ ≈ 3.7 × 10³¹ possibilities — at a trillion guesses per second, exhausting it would take over a billion times the age of the universe. That is the entire case for generators: randomness defeats the wordlists that crack everything else.

The other half of the defence is uniqueness. Most account takeovers today are "credential stuffing" — replaying a password leaked from one site against hundreds of others. A password that is both random and unique makes both attacks irrelevant.

The US National Institute of Standards and Technology publishes the digital-identity guidelines most security teams follow. Several of its recommendations surprise people because they reverse older corporate policy:

• No forced periodic changes. Rotating passwords every 90 days encourages predictable patterns (Password1 → Password2). Change a password only when there is evidence of compromise.
• Length beats composition rules. NIST recommends supporting long passwords and discourages mandatory symbol/number rules, which push users toward formulaic choices.
• Check against breach lists. New passwords should be screened against known-compromised lists — you can check your existing ones at haveibeenpwned.com.
• Allow paste. Blocking paste in password fields breaks password managers and makes security worse, not better.