Password Generator

Length beats complexity

The core of NIST SP 800-63B guidance is not forced symbols but sufficient length and true randomness. A random 12+ character password is effectively brute-force-proof on current hardware; 16+ gives a wide margin.

• 8 mixed characters: crackable within hours to days
• 12 random characters: centuries
• 16 random characters: effectively never

The real risk is reuse

Most account takeovers come from credential stuffing — passwords leaked from one site tried on another — not from cracking. A unique password per site matters far more than any symbol rule, and the only practical way to achieve that is a password manager.

This generator uses your browser's cryptographic RNG (CSPRNG) and never transmits or stores what it generates.