Password generator

how secure is my password

How secure is my password is a question about guessability, not about how tricky it looks to a friend. A short password made of a name and a year is easy to try. A long string from a random password generator is hard to try because the next character is not implied by the last one. Security here means: an attacker who does not already have the secret should not be able to derive it from public facts about you.

Reuse is a separate hole. A strong generated string that you paste into two sites becomes weak the moment one of those sites leaks. The generator’s job is randomness. Your job is one secret per account, stored in a password manager or another vault you control, not in a browser note titled “passwords.”

Human-made complexity rules — a capital letter, a number, a punctuation mark — do not rescue an eight-character word. They slightly enlarge a small space. A longer random string enlarges the space by adding positions. If a site still demands mixed classes, let the generator include them; do not shrink the length to make the extra class fit a tiny box.

Eight, twelve, and sixteen characters

A password generator 8 characters long is a short secret. Eight positions are easier to try than twelve or sixteen, especially if the allowed alphabet is only letters. Some old systems still cap length at eight; that cap is a property of the system, not a recommendation. If you must use eight, make every character random and use the full set the system allows, then treat that account as fragile.

A password generator 12 characters long is a common default on modern tools because twelve random characters already sit beyond what a person invents from memory of a birthday. It is a practical minimum for many generated site logins, not a magic ceiling. If the site allows more, more is better.

A password generator 16 characters long doubles the length of an eight-character secret and adds four characters beyond twelve. Those extra positions are the point. Sixteen is a comfortable length for a manager to store and for a site to accept. Longer still is fine when the field allows it. Do not pad a weak word with “16” at the end and call it sixteen random characters; the generator should pick all sixteen.

8 characters: short; use only when a system forbids more. 12 characters: a solid generated length for many accounts. 16 characters: stronger by length; a good ordinary target when allowed. Passphrase of several random words: another method, still generated, not a lyric you love.

What the tool should actually randomize

A generator worth using draws from a cryptographic random source, not from the time of day and not from a formula a person can repeat. It should let you set length, and it should let you include or exclude symbols when a site forbids them. If a site bans certain punctuation, shorten the alphabet, not the length, unless the field also caps length.

Avoid generators that show a “strength bar” based only on whether you typed a number. A bar cannot see that “Summer2026!” is a season plus a year plus a bang. The honest check is: did I invent this, or did a tool pick it? If you invented it, it is not generated.

When you cannot paste, a password manager’s type-into-field function beats rewriting sixteen characters by hand. Hand copies introduce swaps. If you must read a code aloud, group it and then change it after the call; a secret that has been spoken is a secret you should retire.

The password you can invent on the bus is the password someone else can invent on the next bus. Let a generator be unmemorable on purpose, then store it.