Password Generator

About the Password Generator

A strong, unique password for every account is the single most effective personal cybersecurity measure available to ordinary users. Data breaches at large companies expose hundreds of millions of passwords every year - Have I Been Pwned (haveibeenpwned.com) has catalogued over 13 billion compromised accounts. If you reuse the same password across accounts, a breach at one service compromises all of them. The only defence is a unique, strong password for every account.

Password strength is mathematically quantifiable. A 12-character password using uppercase, lowercase, numbers, and symbols has a character space of 95 possible characters - giving 95^12 or roughly 540 quintillion combinations. At 1 trillion guesses per second (the approximate speed of modern GPU cracking rigs), that would take 17,000 years to brute-force. A 16-character password of the same type would take 540 million years. Length is the single most powerful variable in password strength.

This generator uses the Web Crypto API - your browser's built-in cryptographic random number source. Passwords are generated entirely on your device and are never transmitted to any server. The generation happens locally in JavaScript, which you can verify by turning off your internet connection and testing that the generator still works. For critical accounts (banking, email, UPI apps), generate a 20+ character mixed password and store it in a password manager like Bitwarden (free, open-source) or the built-in manager in Chrome or Safari.

Password Strength

Worked Example

Tips & Insights

• 1

  Use a password manager to store a unique password for every account. Bitwarden is free, open-source, and cross-platform. You only need to remember one strong master password - the manager handles the rest. This is the single most impactful security step you can take.

• 2

  Enable two-factor authentication (2FA) on every account that offers it, especially email, banking, and social media. A compromised password cannot be used without your phone. Use an authenticator app (Google Authenticator, Authy) rather than SMS-based 2FA when possible.

• 3

  Never use personal information in passwords - your name, birthday, phone number, or pet name are the first things an attacker tries. These form the core of dictionary attack wordlists that run millions of personalised guesses per second.

• 4

  A passphrase of 4-5 random words (for example: correct-horse-battery-staple) is cryptographically as strong as a 12-character mixed password and far easier to remember for the few accounts where you must type the password yourself.

• 5

  Check if your email has been in a known breach at haveibeenpwned.com. If it has appeared in any breach, every account where you used that password should be treated as compromised, even if you have not noticed any unauthorised activity.

• 6

  Indian banking apps and UPI platforms have strict character limits on PINs and passwords - sometimes only 4-6 digits. For these, enable biometric authentication wherever available, as it adds a strong second factor without relying on the password length.

• 7

  Do not save passwords in plain text documents, spreadsheets, or notes apps. If your device is accessed physically or your cloud notes are breached, all your passwords are exposed at once. A password manager encrypts the vault with your master password - even the service provider cannot read your stored passwords.