Passwort-Generator - create strong random passwords in your browser

Is all it takes for a single ordinary computer to crack a short password of about 8 characters. It simply fires off millions of guesses a second until one matches. Short passwords just do not stand a chance any more.

Take that same short password and just make it twice as long. Now even every computer on earth working together could keep guessing until the sun burns out and still not get through. That one change, going from 8 characters to 16, is the difference between an afternoon and longer than the universe has existed.

Of people, roughly 2 in 3, use the same password in more than one place. So when one website gets hacked, criminals quietly try that same password on your email, your bank, and everything else. A different password for each account stops that cold.

Harder to crack, just from mixing in capital letters, numbers, and symbols instead of using only lowercase. Every kind of character you add multiplies the guessing an attacker has to do, and it stacks up across the whole password. A good mix does what length alone cannot.

Länge ist der wichtigste Einzelfaktor. Jedes zusätzliche Zeichen multipliziert die Gesamtzahl möglicher Kombinationen. Der Wechsel von 8 auf 16 Zeichen verdoppelt den Suchraum nicht, er quadriert ihn.

Zeichenvielfalt multipliziert den Suchraum. Die Kombination aus Kleinbuchstaben, Großbuchstaben, Ziffern und Sonderzeichen erweitert den Zeichensatz, den ein Angreifer durchsuchen muss, erheblich. Ein Passwort, das nur aus Kleinbuchstaben besteht, hat 26 Möglichkeiten pro Zeichen; werden alle vier Typen hinzugefügt, steigt diese Zahl auf etwa 95.

Vorhersehbare Muster, wie Tastatur-Sequenzen, Namen gefolgt von einem Geburtsjahr oder Lieblingssportteams, tauchen in jedem Angriffswörterbuch auf. Echte Zufälligkeit, erzeugt von einer kryptografischen Quelle, ist gegen Wörterbuch- und regelbasierte Angriffe immun.

Wer ein Passwort für mehrere Konten wiederverwendet, riskiert, dass ein einziges Datenleck alle davon kompromittiert. Jeder Dienst sollte ein eigenes, einzigartiges Passwort haben, damit ein Sicherheitsvorfall stets auf ein einziges Konto begrenzt bleibt.

Mostly out of sight. Sometimes the guessing is aimed straight at a website's login page. More often it happens on a copy of a leaked password list that attackers have already downloaded, where they can guess as fast as their machines allow, completely offline and with no one watching.

Use a long, random, one-of-a-kind password like the ones above, keep it in a password manager, and switch on two-factor login (a second code from your phone or an app) wherever it is offered. Even if one password is guessed or leaked, that second step and a different password everywhere else keep the damage tiny.

Responsible websites slow attackers down: they lock an account after a handful of wrong tries, add small delays between attempts, store passwords scrambled so a leak is not instantly readable, offer two-factor login, and block the floods of automated guesses that bots send.

Look for a web address that starts with https, the option to turn on two-factor login, and a sensible pause after a few wrong passwords. The bot check matters too: many popular ones such as reCAPTCHA and hCaptcha can be solved by cheap services for a fraction of a cent, so they barely slow a real attacker down. Newer privacy-friendly options like PrivCaptcha are a better sign.