How to Generate Secure Passwords Step by Step
Quick Answer
To generate a secure password: open the Password Generator, set the length to at least 16, enable uppercase, lowercase, digits, and symbols, then click Generate. The tool uses crypto.getRandomValues for cryptographically secure randomness. All generation happens locally — no password is ever sent to a server.
Introduction
A strong password is your first line of defense against account takeover. Weak passwords like "password123" or "qwerty" can be cracked in milliseconds by brute-force attacks. A secure password should be long (at least 16 characters), random, and use a mix of uppercase, lowercase, digits, and symbols. This guide shows you how to generate cryptographically secure passwords in your browser using a free online tool, and explains why each setting matters.
Step by Step
-
Open the Password Generator tool
Go to the Password Generator tool page. The tool provides options for length and character sets, and generates passwords using the Web Crypto API (crypto.getRandomValues).
-
Set the password length
Set the length slider or input to at least 16 characters. For high-value accounts (email, banking, password manager master password), use 20-32 characters. Longer passwords are exponentially harder to crack.
-
Choose character sets
Enable all four character types: uppercase letters (A-Z), lowercase letters (a-z), digits (0-9), and symbols (!@#$%^&*). Using all four maximizes entropy. Avoid excluding symbols just because some websites reject them — instead, find a different service.
-
Generate the password
Click the Generate button. The tool produces a random password using crypto.getRandomValues, which provides cryptographically secure randomness (not Math.random, which is predictable).
-
Copy and store the password
Click Copy to copy the password to your clipboard. Store it in a reputable password manager (Bitwarden, 1Password, KeePass) — never in a plain text file, browser note, or spreadsheet. Use a unique password for every account.
Examples
16-character password (all sets)
Input: Length: 16, Sets: upper+lower+digits+symbols
Output: K9#mX!2vRp$7nLqF
32-character password (maximum entropy)
Input: Length: 32, Sets: upper+lower+digits+symbols
Output: jN8$kP!3wQx&7mZrL#2vFtY@5cBhDg
Passphrase-friendly (letters only)
Input: Length: 20, Sets: upper+lower
Output: XkQmPvRnLwZrFtYcBhDg
Common Problems
- Using Math.random() for passwords —it is not cryptographically secure. Always use crypto.getRandomValues() or a tool that does.
- Reusing passwords across accounts —if one site is breached, all your accounts are compromised. Use a unique password everywhere.
- Storing passwords in plain text files or browser notes —use a reputable password manager with encryption.
- Choosing short passwords —an 8-character password with all character sets has only ~52 bits of entropy, crackable in hours on a GPU farm.
Tips
- Use at least 16 characters for important accounts; 20+ for email and password manager master passwords.
- Enable all character sets (upper, lower, digits, symbols) to maximize entropy per character.
- Use a password manager to generate and store unique passwords for every account —you only need to remember one master password.
- Enable two-factor authentication (2FA) on important accounts —a strong password alone is not enough if the service supports 2FA.