Password maker

How it works

You choose a length and a set: lowercase, uppercase, digits, and other marks, or a smaller set if a site forbids some of them. The maker draws a character for each position from that set and prints the string. If you let it pick every position, you get a random string of that length. If you start from a movie title and only sprinkle a digit at the end, you did not use a maker. You decorated a story.

Most honest makers run in the page or inside a password manager and do not send the new string to a server you do not know. A page that ships the result across the network so it can “save your passwords in the cloud” without a vault you chose has turned a maker into a collector. If the page will not tell you where the string travels, do not mint a live login there. Mint inside a manager you already use, or on a local page you can explain.

Length does the heavy lifting. A short string from a tiny set is easy to type and easy to guess. A long string from a mixed set is the opposite. Site rules still win: if a form caps length or bans a mark, the maker has to obey that form, not an ideal alphabet. Read the form. Then generate inside those rails. Fighting a site’s rules with a string far longer than the field allows is how you lock yourself out of a register you needed today.

Make it, store it, stop editing it

A made password you then shorten, swap into a pet’s name, or reuse on a second site is no longer the object the maker produced. The useful habit is: generate, save in a vault, let the filler type it, never reuse it. A unique string keeps someone else’s dump at that one site. The same phrase everywhere turns one dump into a ring of keys. The maker does not watch your other logins. The vault is what keeps them apart.

Length: as long as the site allows, within reason you can store. Set: mixed if the site allows it; drop look-alike glyphs if a human must type it once. Place: a password manager or another vault you control, not a screenshot album.

Reuse: none. A unique string per site is the point. Ambiguous glyphs cause pain when a human must read the string off paper: uppercase I, lowercase L, and the digit 1. If only a manager will store and fill the string, look-alikes are fine. If you must type it on a TV or a friend’s machine, drop the look-alikes or use a font that distinguishes them. That is a reading problem, not a strength lecture.

Do not paste a fresh secret into chat, email, or a “check how strong this is” box you just met. The maker’s job ended when it showed the glyphs. Every extra copy is another place the secret lives. A checker can be useful on a dummy. A live string wants fewer copies, not a public scoreboard.

Maker, checker, and manager

A maker invents. A checker grades a candidate you already have. A manager stores, fills, and usually contains a maker. You still remember one master password for the vault. You do not remember twenty clever variants of an old phrase. That is the whole division of labor. A maker without a vault is a string you will forget or reuse. A vault without a maker is a box of reused phrases with a lock on it.

A password maker that cannot store the string has done half the job. The other half is not “remember this.” If a site later leaks, change that one entry. That is the payoff of uniqueness. If you never stored the made string, you cannot change it cleanly, because you never knew it. Generate into a vault the first time. The second time is already a mess.