How to choose a random password you can use safely
Use a unique, randomly generated password for every account and save it in a trusted password manager. Choose a long value the service accepts; 20 random characters is a practical starting point when supported. Enable multifactor authentication or a passkey when available. Never use a published example as your password.
Random means unpredictable, not complicated-looking
A password built from your name, a year, and punctuation still follows a pattern. Replacing a letter with a familiar symbol does not make that pattern random. A generator should choose characters using a source intended for cryptographic use, such as the browser's Web Crypto random-value API, rather than an ordinary simulation random function.
You do not need to hand-edit a good random result to make it look less unusual. If a service rejects a character, adjust the allowed character set and generate a fresh password. Avoid adding an account name or a predictable suffix yourself.
Choose length before decorating a short password
Length and the number of possible choices both affect a genuinely random password's search space. As a mathematical example, choosing 20 characters independently from 62 letters and digits gives 62 to the power of 20 possible strings. This is not a prediction of an attacker's speed or a guarantee about an account.
NIST's current rules for conforming password-only services require a minimum of 15 characters; a shorter minimum can apply within multifactor authentication. These are verifier requirements, not a claim that every 15-character phrase is strong. A predictable sentence and a random string of equal length have different risks.
Keep each account independent
Reusing a password connects the security of unrelated accounts. If one service exposes it, an attacker can try the same credential elsewhere. Changing only a final digit leaves a pattern that is easy to guess. Generate a separate value for each login and let a password manager associate it with the correct website.
For an important account, creating and storing the password directly inside a trusted password manager reduces the number of places it passes through. Keep recovery information accessible to you, protect the manager itself, and follow its backup guidance before depending on it.
Handle generated values as secrets
A password shown on screen can be exposed by screen sharing, screenshots, extensions, clipboard history, or software on the device. Browser-local generation means the calculation can happen on your computer; that phrase alone does not prove that every script on a webpage is isolated or trustworthy.
Do not paste an existing account password into a strength checker. Generate a new value instead. Save it before leaving the page, then verify that it works on the intended service. Clear unnecessary clipboard copies when practical, and avoid sending passwords through ordinary messages to yourself.
Understand what a generator cannot protect
A long random password cannot stop you entering it into a convincing phishing page, and it cannot repair an already compromised device. It also cannot control how the service stores credentials. Add multifactor authentication and consider passkeys where supported, particularly for email and other accounts that can reset your remaining logins.
A displayed entropy figure describes a model of random selection. A “years to crack” number depends on assumptions about attackers, storage, and rate limits that a simple tool cannot verify. Use the generator for fresh unique values, rather than treating a strength label as a complete security assessment.
Sources & definitions
Method checked: