A strong password has three properties: length (longer is always better), randomness (not based on predictable patterns), and character variety (mix of uppercase, lowercase, numbers, and symbols).
Password strength by length
| Length | Estimated brute-force time |
|---|---|
| 8 characters | Minutes to hours |
| 12 characters | Months to years |
| 16 characters | Centuries |
| 20+ characters | Practically uncrackable |
These estimates assume a sophisticated attacker running billions of guesses per second with GPU acceleration. Real-world attackers usually target reused passwords first — which is why uniqueness matters as much as length.
Why Math.random() is NOT secure
Most basic password generators use JavaScript's Math.random() — a pseudorandom function whose output is deterministic and predictable given the internal seed. In cryptographic terms, it has insufficient entropy.
Privatool's password generator uses crypto.getRandomValues(), part of the Web Cryptography API, which draws entropy from the operating system's cryptographically secure random number generator (CSPRNG). This is the same source used by password managers and cryptographic libraries.
How to generate a strong password
- Go to Password Generator
- Set length to at least 16 characters
- Enable all character sets: uppercase, lowercase, numbers, symbols
- Optionally exclude ambiguous characters (
0,O,l,1) if you need to type the password manually - Click Generate — or generate up to 5 at once for comparison
Password best practices
- Never reuse passwords across different accounts
- Use a password manager — you only need to remember one master password
- Enable two-factor authentication (2FA) on all important accounts
- Never store passwords in plain text files, browser notes, or email drafts
Recommended password managers
- Bitwarden — free, open source, cross-platform
- 1Password — excellent UX, subscription-based
- KeePassXC — offline, open source, no cloud
Length beats complexity
Forced complexity rules — one uppercase, one digit, one symbol — were well intentioned and largely counterproductive. They push people toward predictable patterns: capitalise the first letter, append 1, then !. Password1! satisfies every rule and is among the first things any cracker tries.
The arithmetic favours length. Each additional character multiplies the search space by the size of the alphabet, while adding a symbol to a short password multiplies it once. A 16-character lowercase-only password has a far larger space than an 8-character password using every character class.
NIST's current guidance (SP 800-63B) reflects this: it recommends against mandatory composition rules and periodic forced rotation, and in favour of long passwords checked against known-breached lists.
Passphrases
A passphrase of unrelated words is easy to remember and genuinely strong, provided the words are chosen randomly — dice or a generator, not by you. Human-chosen words cluster heavily around common vocabulary.
correct horse battery staple <- 4 random words
Each word from a 7,776-word list contributes about 12.9 bits of entropy, so four words gives roughly 51 bits and six gives about 77. Use passphrases for the handful of secrets you must type from memory — your device login and your password manager's master password. Use generated random strings, stored in the manager, for everything else.
Where randomness comes from
The article notes that Math.random() is unsuitable. The reason is that it is a deterministic pseudorandom generator seeded from predictable state and optimised for speed, not unpredictability. Given enough output, its internal state can be recovered and all future values predicted.
crypto.getRandomValues() draws from the operating system's cryptographic entropy pool — the same source used for TLS keys. There is no known way to predict its output from previous values.
One subtlety even correct implementations get wrong: modulo bias. Mapping a random byte (0–255) into a 62-character alphabet with % makes the first few characters slightly more likely, because 256 is not divisible by 62. A correct generator rejects and redraws out-of-range values rather than folding them in.
What actually breaks passwords
Ranked by how people are actually compromised:
- Reuse. One breached site exposes every account sharing that password. This is the dominant cause by a wide margin.
- Phishing. Strength is irrelevant if you type it into a convincing fake page.
- Malware. A keylogger captures a 40-character password as easily as a short one.
- Brute force. Last, and only against weak passwords or poor server-side hashing.
Two conclusions follow. A unique password per site matters more than a long one, which is what makes a password manager the single highest-value change. And a strong password does not protect against phishing — two-factor authentication does, ideally a hardware key or an authenticator app rather than SMS.
Frequently asked questions
How long should a password be?
Sixteen characters or more for anything generated and stored in a manager. There is no cost to length when you are not typing it. For passwords you must memorise, use a passphrase of five or six random words.
Should I change passwords regularly?
Not on a schedule. NIST advises against it, because forced rotation drives predictable incremental changes (Spring2026! becoming Summer2026!). Change a password immediately when a service reports a breach, and otherwise leave a strong unique password alone.
Is a password manager risky as a single point of failure?
It concentrates risk, but the alternative — reuse across dozens of sites — is a far larger exposure. Reputable managers encrypt your vault locally with a key derived from your master password, so the provider cannot read it even if breached. Protect the master password with a passphrase and enable two-factor.
Are the passwords generated here safe to use?
They are generated in your browser using crypto.getRandomValues() and never transmitted. No server sees or stores them. As with any tool, generating your most critical credentials offline is the most cautious option — and here you can disconnect from the network first, since the page needs no server.
Do symbols matter?
They add alphabet size and are worth including where accepted, but they are not a substitute for length. Some systems still reject certain symbols, which is a reason to prefer longer over more exotic.