Why use a password generator?
When people invent passwords, they follow predictable patterns: a name, a date, a dictionary word followed by “123” or an exclamation mark. Cracking software tests exactly these patterns first. A generator picks every character at random, so there is no pattern to guess — an attacker has to try every combination, which becomes impossible once the password is long enough.
NewPassGen uses crypto.getRandomValues(), the cryptographic random source built into every modern browser, not Math.random(), which is too predictable for security.
What makes a password strong?
Password strength is measured in bits of entropy: the more bits, the more combinations an attacker must try. Two things raise it:
- length, by far the most important factor;
- character variety (upper and lower case, numbers, symbols).
| Length (all character types) | Approx. entropy | Level |
|---|---|---|
| 8 characters | ≈ 52 bits | Too weak |
| 12 characters | ≈ 79 bits | Fair |
| 16 characters | ≈ 105 bits | Strong |
| 20+ characters | ≈ 131+ bits | Very strong |
Good habits
One unique password per account
When a website is breached, the stolen credentials are immediately tried on other services. Reuse one password and a single leak opens every account.
Use a password manager
Nobody can remember dozens of random passwords; that's a password manager's job (Bitwarden, KeePassXC or the one built into your browser). You only need to remember one master password — ideally a long passphrase.
Turn on two-factor authentication
Enable 2FA (authenticator app or security key) on your important accounts: even if your password leaks, it won't be enough to sign in.
Watch out for phishing
No legitimate service will ask for your password by email, text message or phone. Always check the website address before signing in.
Mistakes that weaken a password
- Using personal information (name, birthday, pet, city).
- Simply swapping letters for numbers (“P@ssw0rd”): cracking tools know these substitutions.
- Adding a number at the end and increasing it at every change.
- Keeping passwords in an unencrypted text file or email.
Frequently asked questions
Are my passwords sent to a server?
No. Everything happens in your browser; you can even disconnect from the internet after the page has loaded and the tool keeps working.
What length should I choose?
At least 14 characters for an everyday account, 20 or more for a sensitive one such as your bank, your main email or your password manager.
How do I remember a random password?
You don't have to: save it in a password manager. Only the master password needs to be memorized.
Should I change my passwords regularly?
Current guidance recommends changing a password after a leak or if in doubt, and above all using a unique password for every site with two-factor authentication turned on.
Why exclude look-alike characters?
Characters such as O and 0, or l, 1 and I, are easily confused. Excluding them is handy if you need to type the password by hand, at the cost of a tiny drop in strength.