Secure Password Generator

The strength of a random password is its entropy, which grows linearly with length and only logarithmically with alphabet size. Adding a character to the length is worth far more than adding symbols to the pool - a 20-character lowercase password is stronger than a 10-character one using every symbol on the keyboard.

This is why complexity rules that mandate a symbol and a digit while capping length at 12 produce weaker passwords than a plain length requirement would. They also push people toward predictable substitutions, which attackers model directly.

Randomness matters as much as length. A password must come from a cryptographically secure source - in the browser that is crypto.getRandomValues, not Math.random, which is fast and predictable and never appropriate for anything secret.

Long random passwords are unmemorable by design, which is the point: they are meant to live in a password manager, not in your head. The two you should memorise are the manager's own master password and your device unlock.

For those two, a passphrase of several random words is easier to remember and type than a random string of equivalent strength. The words must be chosen randomly rather than composed into a sentence - a memorable phrase from a book has almost no entropy.

None of this protects a reused password. A unique password per site is what limits a breach to one account, and it is only practical with a manager, which is the real reason to use one.

Password strength comes from length and randomness. A 12-character password drawn randomly from a pool of 72 possible characters has about 2^74 possible combinations, which is far beyond what any brute-force attack can handle in a lifetime.

Use a different password for every service, and rely on a password manager rather than memory. If one site is breached, unique passwords prevent attackers from reusing your credentials elsewhere.