Password Generator for strong, random passwords

Entropy measures the unpredictability of a password in bits. Each additional character from a larger character set contributes more bits. A password with 128 bits of entropy would require more guesses than current computing technology can attempt in any practical timeframe. The generator's strength bar reflects an entropy estimate calculated in your browser.

Dictionary attacks use lists of millions of common words, phrases, and their predictable substitutions (replacing 'a' with '@', for example). Any password that a human can easily remember usually appears in these lists within the first few million guesses. A randomly generated password with no relationship to words sidesteps dictionary attacks entirely.

Yes. A password manager lets you use a unique, randomly generated password for every account without memorising any of them. You only need to remember one strong master password. Reputable managers store credentials encrypted locally or in the cloud and integrate with browsers to fill passwords automatically. The alternative - reusing passwords or keeping them in a text file - is significantly riskier.

Current guidance from NIST and most security researchers recommends against mandatory periodic rotation unless a password has been compromised. Forcing frequent changes leads users to make minor, predictable modifications (adding a number at the end) which reduces security rather than improving it. Rotate a password immediately if you suspect a breach, if a site notifies you of a data leak, or if you shared the password with someone who no longer needs access.