Why use a password generator instead of making one up?

Humans fall into predictable patterns, such as base words, o-to-zero swaps and a tacked-on year, that attackers try first. A generator produces a string with no relationship to you and makes a unique password per site effortless.

What length should a generated password be?

At least 16 characters where allowed. Length is the biggest factor in strength: every extra character multiplies an attacker's work far more than adding symbols to a short password does.

How do I remember generated passwords?

You should not have to. Store each in a reputable password manager and remember only one strong master credential. For passwords you must type from memory, use a memorable passphrase instead.

Password Generator: Settings That Make a Truly Strong Password

Why Generated Beats Invented

Humans are terrible random number generators. Left to invent a password, people reuse a base word, swap an o for a zero and tack on a year, patterns attackers know and try first. A password generator removes the human pattern entirely, producing a string with no relationship to your name, your pet or your last password. That unpredictability is the whole point, and this one uses the browser's cryptographic random source (crypto.getRandomValues), not the weaker Math.random().

Reuse is the other killer that a generator helps you beat. Because a generator makes a fresh password effortless, there is no excuse to use the same one twice, which is what turns a single site breach into a cascade across your accounts.

The Settings That Matter

Length is by far the biggest lever: every extra character multiplies the work an attacker faces. Aim for at least 16 characters, which is also what CISA recommends; the difference between 8 and 16 is enormous. Character variety (upper, lower, digits, symbols) helps too, but length does more of the heavy lifting than cramming in punctuation. This guide to password entropy shows the math.

Match the settings to the site's rules so the password is actually accepted. The generator lets you set the length from 4 to 128 characters and switch uppercase letters, numbers and symbols on or off; lowercase letters are always included. Keep every character type a site accepts, and if it caps length, use the maximum allowed.

Generate, Store, Forget

A long random password is unmemorable by design, which is fine because you should not be memorizing dozens of them. Generate each one and store it in a reputable password manager, which fills it in for you and means you only ever remember one strong master credential.

For the few passwords you must type from memory, a passphrase of random words is the better tool. A trustworthy generator runs in your browser and sends nothing anywhere, so generate, save the result to your manager and move on. For more on balancing length and complexity, see how to create strong passwords.

Frequently asked questions

Why use a password generator instead of making one up?: Humans fall into predictable patterns, such as base words, o-to-zero swaps and a tacked-on year, that attackers try first. A generator produces a string with no relationship to you and makes a unique password per site effortless.
What length should a generated password be?: At least 16 characters where allowed. Length is the biggest factor in strength: every extra character multiplies an attacker's work far more than adding symbols to a short password does.
How do I remember generated passwords?: You should not have to. Store each in a reputable password manager and remember only one strong master credential. For passwords you must type from memory, use a memorable passphrase instead.

Sources

Use Strong Passwords — Cybersecurity and Infrastructure Security Agency (CISA)
Math.random() - JavaScript — MDN Web Docs