How do I generate a strong password?
Open the page and one is already waiting, since a password is generated on load. Set the length to 16 or more, leave all four character types on unless a site rejects one, press Generate for a fresh result, and use Copy to move it straight into your password manager.
Is this password generator free?
Yes, completely. No signup, no premium tier, and no limit on how many passwords you generate. It is a small piece of JavaScript running in your own browser tab.
Where should I keep the password after generating it?
In a password manager, immediately. A generated password only helps if it stays unique per site, and no one memorises dozens of random 16-character strings. Paste it into the manager entry for the site, not into a note, a chat, or an email to yourself.
Why do I get an error saying to select a character type?
Because every character set is unchecked. The generator draws from the pools you enable, so at least one of lowercase, uppercase, numbers, or symbols has to be on. Turn any of them back on and Generate works again.
Can it generate a memorable passphrase instead?
No, this page produces random character strings only. A multi-word passphrase of the correct-horse-battery-staple style is easier to type on a phone and can be just as strong at sufficient length, but you would need a dedicated passphrase generator for that.
Is this actually secure, or is it Math.random with extra steps?
It uses crypto.getRandomValues, which is the browser's cryptographically secure pseudo-random number generator, seeded from the operating system's entropy pool. That distinction is the whole ballgame. Math.random in V8 is a fast, non-cryptographic algorithm whose internal state can be recovered from a small number of observed outputs, which means passwords generated from it are reconstructable. This generator additionally uses rejection sampling rather than a naive modulo, which removes the small bias that would otherwise make some characters marginally more likely than others.
Does the password ever leave my browser?
No, and this is the reason a browser-based generator can be trusted at all. The password is generated by your own device, exists only in the page's memory, and is never sent over the network, never logged, and never stored. Nothing about it is transmitted to any server, and closing the tab destroys it. A password generator that generates on a server is asking you to trust that the server does not keep a copy, which is not a reasonable thing to ask.
How long should my password be?
Sixteen characters is a good default and gives you roughly 103 bits of entropy with all character types enabled, which is far beyond any feasible brute-force attack against a properly hashed password. Twenty is better and costs you nothing when a password manager is doing the typing. The threshold worth remembering is that below about 12 characters you are relying on the site having hashed your password well, and many sites have not.
Do I need symbols and numbers, or is length enough?
Length is the more powerful lever by a wide margin. Every character you add multiplies the search space by the size of the pool, whereas adding a character class only increases the pool. A 20-character password drawn from lowercase letters alone has more entropy than a 12-character password using all four classes. The practical reason to enable all four is that many sites still enforce composition rules and will reject a password without them, and this generator guarantees at least one character from each class you select so that those forms accept it first time.
Should I change my passwords every 90 days?
No, and NIST now explicitly recommends against it. Forced rotation produces predictable passwords, because people respond to it by incrementing a number or changing a season, which is a pattern an attacker exploits rather than one that defeats them. The current guidance is to use a long, unique, randomly generated password per site, store it in a manager, and change it when there is a reason to: a breach, a suspicion, or a shared credential leaving the team.
Why does the password always contain at least one of each type I selected?
Because sites demand it. The generator picks one character from each selected pool, fills the remaining length from the combined pool, and then shuffles the result so the guaranteed characters are not always at the front. This costs a negligible amount of entropy compared with pure random selection, and it means the password will not be bounced by a form that insists on at least one digit, which is a far more common frustration than the theoretical loss is a risk.