Password & Security
Generate and check strong passwords.
About Password & Security
A password is only as good as the way it was generated, and human-chosen ones are guessable in patterns attackers know well. The generator here uses your browser's cryptographic randomness rather than ordinary maths randomness, and can exclude the characters that certain sites refuse to accept, so you do not have to regenerate three times to satisfy a form. The strength checker estimates how long a real cracking attempt would take rather than counting character types, which is why a long passphrase scores better than a short string of symbols. Nothing you type is transmitted or stored.
Length beats complexity, and it is not close. Each extra character multiplies the number of possibilities an attacker has to work through, while swapping an "a" for an "@" adds almost nothing — that substitution is in every cracking dictionary and has been for decades. This is why a four-word passphrase you can actually remember outperforms a short knot of symbols you cannot, and why the generator offers both: symbols for the passwords a manager will remember for you, words for the few you have to type yourself.
The strength checker is a guide, not a guarantee. It can tell you that a password is structurally weak, which is worth knowing. It cannot tell you that one is safe, because the thing it cannot see is reuse — a genuinely strong password becomes worthless the moment the same one is used on a site that gets breached. Unique per site is the habit that matters most, and it is the one a password manager exists to make possible.