Password Generator - create strong random passwords in your browser

Is all it takes for a single ordinary computer to crack a short password of about 8 characters. It simply fires off millions of guesses a second until one matches. Short passwords just do not stand a chance any more.

Take that same short password and just make it twice as long. Now even every computer on earth working together could keep guessing until the sun burns out and still not get through. That one change, going from 8 characters to 16, is the difference between an afternoon and longer than the universe has existed.

Of people, roughly 2 in 3, use the same password in more than one place. So when one website gets hacked, criminals quietly try that same password on your email, your bank, and everything else. A different password for each account stops that cold.

Harder to crack, just from mixing in capital letters, numbers, and symbols instead of using only lowercase. Every kind of character you add multiplies the guessing an attacker has to do, and it stacks up across the whole password. A good mix does what length alone cannot.

Length is the single most important factor. Every additional character multiplies the total number of possible combinations. Going from 8 to 16 characters does not double the search space - it squares it.

Character variety multiplies the search space. Mixing lowercase, uppercase, digits, and symbols dramatically expands the character set an attacker must search. A password limited to lowercase letters has 26 possibilities per character; adding all four types raises that to roughly 95.

Predictable patterns - keyboard walks, names followed by a birth year, favourite sports teams - appear in every attack dictionary. True randomness, generated by a cryptographic source, is immune to dictionary and rule-based attacks.

Reusing a password across accounts means one breach exposes all of them. Each service should have its own distinct password so that a compromise is always contained to a single account.

Mostly out of sight. Sometimes the guessing is aimed straight at a website's login page. More often it happens on a copy of a leaked password list that attackers have already downloaded, where they can guess as fast as their machines allow, completely offline and with no one watching.

Use a long, random, one-of-a-kind password like the ones above, keep it in a password manager, and switch on two-factor login (a second code from your phone or an app) wherever it is offered. Even if one password is guessed or leaked, that second step and a different password everywhere else keep the damage tiny.

Responsible websites slow attackers down: they lock an account after a handful of wrong tries, add small delays between attempts, store passwords scrambled so a leak is not instantly readable, offer two-factor login, and block the floods of automated guesses that bots send.

Look for a web address that starts with https, the option to turn on two-factor login, and a sensible pause after a few wrong passwords. The bot check matters too: many popular ones such as reCAPTCHA and hCaptcha can be solved by cheap services for a fraction of a cent, so they barely slow a real attacker down. Newer privacy-friendly options like PrivCaptcha are a better sign.