Password Security Guide

Generate a new random password between 8 and 20 characters long, and choose which character groups to include: lowercase and uppercase English letters, digits, and special symbols. For a regular personal account, pick the maximum length supported by the service — in this tool that's 16–20 characters — and never reuse the generated password elsewhere.

What makes a password strong

For a randomly generated password, these factors matter most:

1. Length. The more independent random characters you have, the more possible combinations an attacker must try.
2. Unpredictability. Names, birthdays, website names, keyboard patterns, and famous quotes are far easier to guess than a truly random string.
3. Uniqueness. Using the same password across multiple services is one of the most common and dangerous security mistakes.
4. Secure storage. A complex password is useless if it sits in an unencrypted file or is shared with people who shouldn't have it.
5. Protection against post-breach reuse. If a password is compromised, it must be replaced everywhere it was used.

Adding different character types expands the set of possible combinations. However, the modern recommendation is not to compensate for short length with mandatory patterns like "one uppercase, one digit, one symbol." For a random password, length and uniqueness are usually more important than an artificially complex template.

What length should you choose

The current NIST SP 800-63B-4 publication requires systems to accept at least 15 characters for single-factor passwords; when a password is used only as one factor in multi-factor authentication, a minimum of 8 is allowed. Services are also required to permit passwords of at least 64 characters.

These are requirements for systems, not a guarantee that any 15-character password is automatically secure. For a generator with a range up to 20 characters, here's a practical guide:

• 16–20 characters — the preferred range for most new accounts;
• 20 characters — a sensible default choice if the site accepts that length;
• 8–14 characters — use only when a specific system imposes restrictions or in a multi-factor scenario, understanding that a longer password is always better.

For especially important systems, use a password manager that can generate and store longer values if the service supports them.

Should you include all character groups

First, check the rules of the specific site. Some systems:

• require at least one digit or special character;
• only allow a restricted set of symbols;
• incorrectly handle spaces, quotes, or other characters;
• have an outdated maximum length limit.

Include lowercase and uppercase letters, digits, and special symbols if the service accepts them. But don't shorten your password just to manually satisfy all requirements.

Why you should never reuse a password

After one site suffers a breach, attackers will automatically test the same email and password pair on other services. A unique password limits the damage to a single account.

Don't create variations like:

MyPassword-gmail
MyPassword-amazon
MyPassword-bofa

The common base remains predictable. For each service, generate a completely independent value.

How to store generated passwords

The best practical solution is a password manager. It lets you:

• store a separate password for every account;
• automatically fill credentials only on the matching domain;
• generate long random values;
• identify reused or known compromised passwords;
• sync your encrypted vault across devices.

The master password for your manager should be long, memorable, and unique. Where available, enable multi-factor authentication or a passkey.

When to change your password

Change your password:

• if the service notifies you of a breach;
• if you entered it on a suspicious site;
• if it was sent over an insecure channel;
• if someone who no longer needs access knows it;
• if your device or storage may have been compromised;
• if the password is reused on another account.

NIST does not recommend forcing periodic password changes without signs of compromise. Frequent mandatory rotation by calendar often leads to predictable patterns like PasswordMay → PasswordJune. Uniqueness, sufficient length, and prompt change after a real risk are far more important.

Temporary passwords and contractor access

For temporary access, it's safer to create a separate account with minimal privileges and an expiration date, rather than sharing the owner's primary password.

If your system still uses a temporary password:

1. transmit it over an agreed secure channel;
2. don't send the username and password together in a single open message;
3. require a change on first login;
4. revoke access immediately after work is complete;
5. review the login history and active sessions.

The generator creates a string, but it doesn't manage permissions, transmission, or access revocation.

What "unique password" means

On this page, it should be understood as "a newly generated independent password." An online generator cannot prove that this exact combination has never appeared anywhere else. With a sufficiently large space of random possibilities, a collision is extremely unlikely, but the service does not verify absolute global uniqueness.

What the tool should not promise without technical verification

You cannot automatically claim that a password is generated by a cryptographically strong random number generator unless that is confirmed by the implementation. For such a promise, developers must verify that the browser uses a cryptographic API, such as crypto.getRandomValues(), rather than the ordinary Math.random().

Recommended internal security review for implementation:

• generation via the browser's CSPRNG;
• uniform character selection without bias;
• no recording of passwords in analytics, logs, or URLs;
• no sending of the value to a server;
• clearing sensitive values from the DOM on reset;
• correct operation when each character group is disabled.

Until this is confirmed, it's safer to write "random password" in user-facing text rather than "cryptographically strong."

Additional account protection

A password is only one layer of defense. For important accounts:

• enable multi-factor authentication;
• prefer using a passkey, hardware key, or authenticator app if the service supports it;
• store backup codes in a secure place;
• verify the domain before entering your password;
• don't approve unexpected login requests;
• terminate unknown active sessions.

Frequently asked questions

Why is a long password better than a complex short one?

Length increases the number of possible random combinations. A short password with predictable substitutions like a → @ can remain weak, even if it formally contains different character types.

Do I need to change my password every 30 or 90 days?

Not without reason. Change it after a breach, suspicious entry, sharing with someone who no longer needs it, or any other sign of compromise. Regular calendar-based rotation alone does not replace uniqueness and length.

Can I save my password in the browser?

A modern browser's built-in password manager is generally safer than reusing weak passwords or storing them in an open file. Protect your device itself, your sync account, and enable additional authentication.

Why won't the site accept my special character?

The service may have a restricted set of allowed characters or an outdated validation check. Generate a new version using only supported groups while keeping the length as long as possible.

Can I send a password over a regular messaging app?

For sensitive access, use a secure secret-sharing feature, a separate account, and require the temporary password to be changed after first login. Never leave permanent passwords in shared chat history.

Does the generator guarantee that passwords are never stored?

This depends on the technical implementation of the page. Such a promise should only be made after developers have verified network requests, analytics, and logging.

Related tools: Base64 Encoder, Text Processor.

Official recommendation:

• NIST SP 800-63B-4 — Digital Identity Guidelines: Authentication and Authenticator Management: https://pages.nist.gov/800-63-4/sp800-63b.html