What makes a password actually strong
Strength comes from entropy — how many guesses an attacker would need, on average, to land on your exact password. A long, random string drawn from a large character set (lowercase, uppercase, digits, symbols) has far more entropy than a short word with a number tacked on, even if the short one looks “complicated” to a human. As a rule of thumb, 16+ random characters or a 5-word Diceware passphrase both comfortably exceed what offline brute-force cracking can realistically reach.
Random characters vs. passphrases
A random-character password (e.g. qX7$mK2!vL9pR4nQ) packs the most entropy per character but is hard to type or memorize — best for password managers. A Diceware passphrase (e.g. correct-horse-battery-staple-orbit) is built from a large word list and is easier to type and remember while still being cryptographically strong, provided it’s long enough (4-6 words minimum) and the words are chosen randomly, not picked by hand.
Why character exclusions matter
Some systems reject certain symbols, and some fonts make characters like l, 1, I, and 0/O hard to tell apart when a password has to be typed from a screen or printout. Excluding ambiguous characters trades a small amount of entropy for far fewer transcription errors — worth it for passwords a person will actually type by hand.
Why generate passwords locally
This generator uses your browser’s cryptographically secure random number generator and never sends the length, character set, or generated password to a server. Nothing is logged, cached, or transmitted — the only copy of the password that exists is the one on your screen.