TL;DR: Generate a strong password online by choosing a browser-based generator that uses the Web Crypto API, setting the length to 16 characters, and enabling uppercase, lowercase, numbers, and symbols. A generator that runs locally never sends or stores the password.
The trick is not the password itself, it is how it is created. This guide explains why a 16-character mixed password beats a complex 8-character one, why the random number source decides whether a generator is actually secure, and what a safe tool does and does not do with your data.
What makes a password strong?
Strength is measured as entropy, the number of guesses an attacker must try. Entropy grows with the length and with the size of the character set, and length matters more.
- A 12-character password drawn from the full 95-character set has about 79 bits of entropy.
- A 16-character one has about 105 bits.
- An 8-character numeric PIN has about 27 bits.
A 105-bit password would take an impractical amount of time to brute-force even with specialized hardware. Keep it over 12 characters, mix the character types, and it holds.
Why does the random source matter?
Not every "random password generator" is actually secure. The distinction is the random number source.
- Math.random() is a general-purpose function. Its output is predictable enough to be reverse-engineered, so a password built on it is guessable by someone who knows the algorithm.
- crypto.getRandomValues() is a cryptographically secure random number generator, the same standard used for online banking and TLS encryption. Its output cannot be predicted in practice.
A secure generator must use the Web Crypto API. The Crypto.getRandomValues() reference on MDN documents the function and its guarantees. If a tool page does not mention crypto randomness, treat its output as unreliable.
How do you generate a secure password online?
The Password Generator on EasyToolsBox uses crypto.getRandomValues() and runs entirely in your browser. To generate one:
- Set the length. Start at 16 characters for important accounts.
- Enable all four character types: uppercase, lowercase, numbers, and symbols.
- Click generate and copy the password straight into a password manager.
The tool also shows a strength rating of weak, fair, good, or strong so you can see the effect of length and character choices before copying.
How long should a password be?
Industry consensus and password managers recommend 12 to 16 characters for important accounts, and the guidance from NIST points the same way: favor length over arbitrary complexity rules. A long passphrase such as four random words is often easier to type than a short string of symbols, and it carries more entropy.
If a site limits you to 8 characters, use the full character set anyway and change the password as soon as the site allows longer ones; the limit itself is a warning that the site is weak.
Password generator vs password manager: do you need both?
They solve different problems. A generator creates one strong, random password. A manager stores it, autofills it, and generates a different one for every site so a breach on one site does not expose the others.
Generate with a generator, save with a manager. Using a generator without a manager produces passwords no one can remember, which pushes people to reuse them or write them down, both worse than a slightly shorter memorable password.
Is a password generator safe to use?
It depends on where generation happens. Server-based generators create the password on their machine and could log it, though most do not. A browser-based generator creates it locally with the Web Crypto API: the password exists in your browser tab, is copied, and is gone when the tab closes. Nothing is transmitted after the page loads. You can verify this by loading the generator and disconnecting from the internet; it still produces passwords.
Common password mistakes
- Reusing one password everywhere. A breach at any site becomes a breach everywhere.
- Using personal details. Names, birthdays, and pet names are the first things an attacker guesses.
- Writing the password on a sticky note. A manager removes the need.
- Trusting short "random" passwords. An 8-character password from a non-crypto source is weak even if it looks random.
- Replacing letters with symbols. "P@ssw0rd" is a known pattern, not a strong password.
FAQ
Is my password sent to a server?
No, if the generator runs locally. The EasyToolsBox Password Generator creates passwords in your browser with the Web Crypto API and transmits nothing. You can confirm by disconnecting from the internet and generating one.
How many characters should a strong password have?
At least 12; 16 is the recommended default for important accounts. Each added character multiplies the guesses required, so length is the most effective single lever.
Is it safe to use a free password generator?
Yes, when it runs in the browser and uses cryptographically secure randomness. Free server-based tools are a privacy risk because your password passes through their infrastructure, even if they do not store it.
Should I generate a password or make one up?
Generate it. Human-created passwords follow predictable patterns that cracking tools exploit. A random password from a crypto-secure generator has no pattern to exploit.
How should I store my generated passwords?
Use a password manager that encrypts your vault. Never save passwords in a plain text file, spreadsheet, or notes app that syncs without encryption.