How to generate secure passwords

Entropy in one paragraph

Entropy measures how many guesses an attacker needs on average, expressed in bits. Each bit doubles the work. A password drawn at random from an alphabet of 94 printable characters carries about 6.55 bits per character, so a 16-character random password is roughly 105 bits — far beyond brute force with current hardware.

Length beats symbol soup

Adding one random character multiplies the search space by the alphabet size. Swapping an 'a' for an '@' multiplies it by almost nothing, because every cracking dictionary already applies that substitution. Prefer a longer random string, or a passphrase of five or more randomly chosen words.

Where randomness comes from

Math.random() is not a cryptographic generator: its output is predictable given enough samples. Browser tools should use crypto.getRandomValues, which draws from the operating system's entropy pool. Our password generator uses it with rejection sampling so no character is subtly more likely than another.

Reuse is the real risk

Most account takeovers are not cracked passwords; they are credentials reused from another site's breach. A unique password per site removes that entire attack class, which in practice means using a password manager. The manager's own master password is the one you should memorise, and it should be a long passphrase.

• ·Never reuse a password across services.
• ·Turn on two-factor authentication wherever it is offered.
• ·Rotate a password when a service discloses a breach, not on an arbitrary schedule.

Storing passwords as a developer

If you handle other people's passwords, hash them with a slow, salted algorithm designed for the job — Argon2id, scrypt or bcrypt. General-purpose hashes like SHA-256 are far too fast for this use, and MD5 should never appear anywhere near a credential.