Strong password generator

How to Create a Strong Password You Do Not Have to Remember

Most people still create passwords following the same pattern: first name, birth year, pet name, and an exclamation mark at the end. Such a password looks complex, but it is fairly predictable for password guessing software, because all the information about you can be found on social media. The practical rule is simple: a strong password should not be memorized, it should be generated and stored in a password manager.

The process is short:

1. Choose a length of at least 16 to 20 characters.
2. Allow all letters, numbers, and symbols, with no exceptions like "I do not use the letter O".
3. Generate the password and save it in the password manager immediately, before you paste it into the login form.
4. Create a new password for every account, never a variation of the same one.
5. Enable two factor authentication wherever it is available.

The key difference compared to "manual creation" is that the generator picks characters without any logic you could reproduce. That is why such a password is both harder to remember and harder to guess, which is exactly what you want.

What Is Password Entropy and Why Length Matters More Than Symbols

Entropy is a measure of password unpredictability, expressed in bits. Roughly speaking, every bit of entropy doubles the number of attempts needed to guess the password. When you choose characters from a large set (lowercase and uppercase letters, digits, symbols), every additional character adds more entropy than most people expect. That is why a 20 character random password has a huge advantage over "P@ssw0rd2024!" which looks complicated but is actually assembled from known words and patterns.

A practical example: an eight letter word with substituted letters (a becomes @, o becomes 0) seems secure, but cracking tools have exactly such substitutions built into their dictionaries. A random string of 20 characters has no such pattern, so a dictionary attack against it does not work.

Expert tip: if a service has a password length limit (for example 12 or 16 characters), that is a sign its backend is probably outdated. In that case, choose the maximum allowed length and be sure to enable MFA, because the password alone then carries less protection than you would like.

Is It Safe to Generate a Password in the Browser

It is safe if the generator uses a cryptographically secure source of randomness, a so called CSPRNG, and not an ordinary mathematical function that only "looks random". The difference matters: a predictable generator can produce a sequence that an attacker can reconstruct if they know enough previous values.

The second part of the story is where the password ends up. When generation happens in your browser, the password does not travel over the network and does not remain on the website's server. This matters, because there is no point in having a perfect password if it is written somewhere in a log file or a database you do not control.

Expert tip: check whether the site uses HTTPS and whether the generator description clearly states that nothing is sent to the server. If a generator asks you to enter the password or send it by email in order to "save" it, that is a red flag.

Most Common Password Management Mistakes

• The same password in multiple places. When one service is compromised, attackers automatically try the same combination on email, banking, and social media.
• Minor changes to the same password. Adding a number at the end or changing one letter does not create a new password, but a variation that tools easily guess.
• Storing it in a notebook or a spreadsheet on the desktop. A password manager exists precisely so that the record is encrypted, rather than available to anyone who approaches the computer.
• Sharing passwords by email or message. For shared company accounts, use access sharing tools with a record of who used what.
• Neglecting MFA. Even the strongest password is vulnerable if there is no second factor of protection.

When it comes to a larger number of accounts, employees, or server infrastructure, individual generators are not enough. As part of IT infrastructure maintenance, EVI Solutions sets up password policies, access management, and MFA so that protection is systemic rather than a matter of individual discipline.