Password generator

Why generate a password instead of making one up

A made-up password is almost always predictable: a name, a birth year, a company name, “Qwerty” with an exclamation mark at the end. Attackers try these first, using dictionaries built from past leaks. A random string never appears in those dictionaries, so the only way in is blind guessing.

Length matters more than cleverness. Every extra character multiplies the number of options, so 16 random characters beat 10 characters with letters swapped for look-alike digits.

How this generator works

The password comes from your browser's cryptographic random number generator (the Web Crypto API). Nothing goes to our server: once the page has loaded you can go offline and keep generating.

Every password contains at least one character from each set you ticked: if digits are on, there will be a digit. The “no look-alikes” option removes 0 and O, 1, l and I, which helps when a password has to be read off a screen or dictated.

Where to keep passwords

In a password manager: KeePassXC, Bitwarden, 1Password or the one built into your browser. Not in phone notes, a file on the desktop or a chat: messages and email get read when an account is hacked, on a shared device or after an employee leaves.

Use a separate password for every service. Then a leak at one site does not unlock the rest of your accounts.

Passwords for your website's admin panel

Websites are often broken into through a guessed password for the admin panel, FTP or hosting control panel. The minimum worth doing:

• a unique password of 16+ characters for everyone who logs into the admin panel;
• two-factor authentication wherever it is available;
• a separate account for each employee and contractor instead of one shared login;
• access removed on the day a person stops working with you.

Passwords do not belong in the site's code or repository. If the database password is written into project files, anyone with a copy of the code gets the database too.