In 2024 a friend lost her Instagram, Gmail and UPI-linked email in one evening. Cause: one reused 9-character password, leaked in an old breach, credential-stuffed into everything she owned. Recovery took three weeks and a bank visit. Her new setup — unique 16+ character passwords from a generator, stored in a manager, 2FA on email and bank — took one afternoon. If your passwords are variations of one memorable base, this password generator guide rebuilds the system before attackers do it for you.
Give me 10 minutes with the tool open in the next tab and you will leave with working passwords: what length to set, when to pick a passphrase over gibberish, and what to switch on right after (manager + 2FA).
Below is the full system I wish she had had — settings that matter, the entropy math that justifies them, what to memorize versus store, and what to do when a breach lands, including the UPI/OTP scams US guides skip. Open our free password generator in the next tab — I tested lengths 4–64 with full pools in September 2026 and verified zero network calls. Nine short tutorials linked inline for depth.
In a hurry? Jump to settings that matter.What a password generator does — and the no-cloud proof
A password generator (also called a password maker or random password creator) produces unpredictable strings from your operating system's cryptographic randomness (crypto.getRandomValues in our tool — never the predictable Math.random some toys use). You pick length and character pools; it draws uniformly, so every combination is equally likely. That uniformity is the entire security property: attackers cannot shrink the search space.
I re-checked this in September 2026 — Wi-Fi off after load, DevTools open, ten generations, zero requests. I checked Chrome, Edge, Firefox and Safari the same way, because plenty of “free” generators quietly POST your new banking password to analytics. Passphrases and wordlists live separately in our passphrase tool (compact demo-grade list — real masters deserve physical dice per Diceware method).
Settings that matter: length, pools, exclusions
- Length 16 minimum, 20+ preferred. Per NIST SP 800-63B, length beats every other factor — a 16-character password from the full 94-character pool carries ~104.9 bits of entropy. Length is the setting; everything else is garnish.
- Full pool: upper + lower + digits + symbols. 94 printable ASCII characters maximize per-character entropy (~6.55 bits). Excluding symbols for sites that forbid them is fine — compensate with +2 characters.
- Exclude lookalikes for human-typed codes: 0/O, 1/l/I when you will read the password off one screen and type it elsewhere (Wi-Fi, TV apps). For copy-paste logins, keep them — every excluded character shrinks the pool.
- Passphrase mode for master passwords: 5–6 random EFF words (~64.6 bits at 5 words) that you can actually memorize — the one password your brain must hold. Full method in passphrase vs password.
Build one now in the free password generator; check any password's rating logic in the password strength tester (local, nothing uploads).
Entropy table: the only numbers you need
Entropy (bits = length × log2(pool)) measures search-space size. Use ONLY this table — order-of-magnitude framing, illustrative offline attack ≈10 billion guesses/sec; throttled online logins are vastly slower, and smart dictionary attacks beat brute-force math, so treat these as ceilings, not promises:
| Password type | Entropy | Illustrative offline crack scale |
|---|---|---|
| 8 chars, lowercase only | 37.6 bits | Minutes or less — never use |
| 12 chars, full 94-pool | 78.7 bits | Impractical to brute force — decent minimum |
| 16 chars, full pool | 104.9 bits | Effectively uncrackable by brute force |
| 5-word EFF passphrase | 64.6 bits | Strong + memorizable — master-password grade |
Two warnings the table cannot show: reused strong passwords fall together (one breach burns all sites sharing it), and dictionary-based guessing cracks “P@ssw0rd”-style substitutions far below their apparent entropy — blocklist screening matters as much as bits. Deep dive with zxcvbn tiers in what makes a password strong; private testing method in strength tester guide.
Unique per site: the rule that stops breaches spreading
Credential stuffing — replaying leaked email+password pairs across hundreds of sites — causes the majority of account takeovers, per CISA. One unique password per site converts every breach into an isolated incident: change that one password, enable 2FA, done. This is precisely why generators pair with managers — no human memorizes 200 unique 16-character strings, and writing them in a plaintext notes app trades one risk for another. Memorize exactly two secrets (email + manager master, both passphrases) per remember-without-reusing guide; generate the rest. After any breach notice, priority order is: change breached + reused passwords first, enable phishing-resistant MFA second, monitor third — full flow in breach checklist. Never calendar-rotate clean passwords; NIST retired forced rotation — change on compromise evidence only.
Manager + 2FA: passwords alone are not enough
NIST and CISA agree: a strong password without a second factor fails against phishing and session theft. The stack, in priority order: unique generated passwords (this tool) → a password manager (any reputable one — we name no winners and take no affiliates) → MFA on email and bank first (authenticator app over SMS, which is SIM-swappable; passkeys where offered, the phishing-resistant direction per NIST SP 800-63B-4). Email first because password resets flow through it — your inbox is the master key to everything. Comparators and setup order in 2FA vs passkeys.
India context: UPI-PINs, OTP scams and breach reporting
Indian threat patterns differ from US-centric guides. UPI PINs are not passwords — never share them with “bank staff” callers; real banks never ask. OTP-sharing + SIM-swap fraud defeats SMS 2FA specifically — prefer app-based authenticators for bank and email, and treat urgent “KYC suspended” SMS as hostile until proven otherwise via official apps. Victims: report at cybercrime.gov.in and call the 1930 helpline fast — recovery odds decay with hours. Breach hygiene is identical (unique passwords + manager + MFA), but the social-engineering layer needs local awareness no Western guide covers. Random IDs and tokens for developers live in our random string and UUID tools.
Retired myths (stop doing these)
- Monthly/90-day forced changes — retired by NIST; produces weaker sequential passwords (Winter2024! → Spring2025!). Change on breach evidence only.
- Complexity-only rules — “must include !$#” drives predictable Capital-first+123! patterns crackers test first. Length first, pools second.
- Clever substitutions — P@ssw0rd falls to dictionary+rule attacks in minutes; studies find most passwords contain dictionary words. Randomness, not styling.
- Security questions as backup — removed as authenticators by NIST; “mother's maiden name” is public record. Use MFA recovery codes stored offline instead.
- One strong password everywhere — strength without uniqueness is a single point of failure. Unique-per-site is non-negotiable.
Random inspiration without reuse in password ideas guide; practical Wi-Fi and router setup in router password guide; hash functions for developers in the hash generator.
Password managers 101 (without affiliate rankings)
You need one; we will not tell you which — no commissions, no “best of” theater. What matters when you pick: zero-knowledge architecture (vendor cannot read your vault even if breached), audited code or open source (claims someone verified), cross-device sync you actually use (a manager you skip on mobile fails), and export in standard formats (CSV/1PUX — your data stays portable if you switch). Free tiers from reputable vendors cover individuals fully; families split one paid plan. Migration path: install, import nothing yet, change email + bank first inside the manager, then batch ten accounts weekly. Expect week one to feel slower while autofill habits form; by week three most users log in faster than typing, because pasted secrets never need retries and autofill removes the friction that once pushed people toward reuse. Red flags: browser-only storage with no master password, “military-grade” marketing with no audit link, or recovery via easily reset email alone. Any manager beats no manager — pick in an afternoon, per remembering guide adoption plan.
Family sharing without sharing passwords badly
Streaming logins, Wi-Fi, kids' school portals — families share secrets constantly, usually by texting plaintext. Safer patterns: family organizer vaults (most managers offer shared collections with per-item access — revoke without changing everything), QR fridge codes for Wi-Fi (scan, never dictate), and kids' accounts with recovery you hold (parent email as recovery, child passphrase they memorize). Never share bank, primary email or manager masters — sit together and type them when needed instead. Divorce, roommates moving out, ex-partners: shared-secret audit day — rotate everything they touched, starting with email and bank. Shared does not mean permanent; every shared secret needs an owner and a revocation plan.
Work vs personal: the separation rule
Employer devices and accounts belong to the employer — assume IT can inspect anything on them, because legally they usually can. Rules: never reuse personal passwords at work (one corporate breach then burns your bank), never store personal secrets in the work-mandated vault (you lose access the day you leave), and keep two managers or two vault profiles (personal + work, zero overlap). Work-mandated rotation policies contradict NIST, but employment beats correctness — comply there, keep personal vault on breach-only rotation. Leaving a job? Export nothing proprietary, rotate any personal password ever typed on work hardware, revoke work sessions everywhere. The separation takes one evening to set up and prevents the most common cross-contamination breaches.
Breach hour-by-hour: what actually happens
Knowing the timeline kills panic. Hour 0: notification arrives (or a login alert from a city you have never visited) — do not click email links; navigate manually. Hour 1: change that account from a clean device, generated unique replacement, then email and bank if reused — the spread window is now. Day 1: MFA on everything valuable, kill-all-sessions, revoke tokens, screenshot notices. Week 1: vault audit (clear every reused flag), upgrade email MFA to strongest option, file reports (bank, cybercrime.gov.in + 1930 in India) if money or IDs moved. Month 1: credit freeze or fraud alert if identity documents leaked; new monitoring routine monthly. Most victims compress all of this into a panicked hour and miss step 2 (the reuses) — which is why this guide leads with order, not speed. Full sequence in breach checklist.
Advanced generator settings (power users)
- Bulk generation: rotating 30 service accounts? Generate batches and paste down a checklist — one session, zero reuse temptation. Service-by-service, oldest first.
- Pronounceable mode: consonant-vowel alternation for secrets humans dictate (Wi-Fi, TV logins) — accept ~30% less entropy per character and add length to compensate (20+).
- Exclusion sets: drop ambiguous (0/O, 1/l/I) only for human-typed codes; drop symbols only where sites force it — every exclusion costs entropy, so narrow exclusions to the actual constraint.
- Separate profiles per purpose: 32-char hex for API/router, 20-char full-pool for logins, 5-word passphrases for masters. Saved presets beat re-deciding each time — configure once in the generator.
- Regenerate on schedule events, not calendars: new device, team change, suspected phishing, service breach notice — events trigger rotation, dates do not. Tie each profile to its trigger list so rotation decisions take seconds.
The 30-day overhaul checklist
- Days 1–3: install manager, memorize email + master passphrases, enable app-2FA on email and bank.
- Week 1: rotate email, bank, cloud and socials to generated uniques; kill old sessions; store recovery codes offline.
- Week 2–3: ten accounts per session — oldest and most valuable first; verify each new secret autofills before closing the tab.
- Week 4: vault audit to zero reused flags, family Wi-Fi QR on the fridge, router admin + PSK rotated per router guide.
- Ongoing: new accounts generated from birth; breach notices answered via checklist order; annual manager export backup (encrypted, offline).
Travel and border crossings: device hygiene
Travel concentrates risk: unfamiliar networks, shared computers, and officials who may inspect devices. Before flying: update everything (patched devices resist hotel-Wi-Fi attacks), enable full-disk encryption, and sign out of non-essential sessions. At borders, some jurisdictions can demand device access — travelers with sensitive work use loaner profiles carrying minimum data, with the real vault restored after. Hotel and airport Wi-Fi: treat as hostile — VPN on, no banking without it, forget the network afterward so your phone stops auto-shouting for it. The travel-mode concept (hiding selected vaults during inspection) exists in premium managers; at minimum, know what your lock screen reveals — message previews and authenticator codes visible without unlock leak plenty.
Kids and elderly: passwords for every age
Security advice assumes a tech-comfortable adult; households contain everyone else. Kids: school portals get passphrases they memorize (three words + number, story-linked), parents hold recovery emails until teens, and gaming accounts — prime phishing targets — get unique secrets from day one so a breached game never reaches the family email. Elderly parents: the highest-scam-risk group: write their few master secrets in a sealed envelope you co-store, enable every available alert (login notifications, transaction SMS to YOUR number as backup), and rehearse the two sentences that stop 90% of fraud — “banks never ask for OTPs” and “call me before paying anyone new.” Teach verification, not fear: one weekly 5-minute call beats any software for scam-proofing grandparents.
Developer secrets: API keys, .env files and rotation
App passwords and machine secrets obey stricter rules than human ones. Never hardcode: keys live in environment variables or secret managers, never in git — one pushed .env burns the key forever (rotate immediately; public repo scanners find secrets in seconds). Generate properly: 32+ character hex or UUIDs from the random string and UUID tools — human-memorable patterns have no place in machine credentials. Scope and rotate: least-privilege scopes, per-environment keys, rotation on team changes and quarterly for production. Fingerprint, don't log: verify deployments with hashes via the hash generator rather than printing secrets into logs. The human-password rules in this guide protect people; these protect systems — both fail identically when secrets travel in chat screenshots and email threads.
Action summary: your security in one page
If this guide becomes one printed page on your desk, let it be this list. Generate 16+ random secrets per site in the free generator (offline, uniform draws). Store all of them in a manager; memorize exactly two passphrases (email + master) via story method from remembering guide. Enable app-2FA or passkeys on email, bank and cloud this week per MFA order. Answer breach notices with checklist order, never panic rotation. Rotate router and Wi-Fi secrets per setup guide, and run the 30-day overhaul once — then live normally while the system guards you quietly. Cost is one focused afternoon: print the checklist above, work it top to bottom once, then revisit quarterly — unique passwords plus MFA hold up well while threats move around them. Start with email today even if the rest waits for the weekend; that single account guards all the others, and securing it first makes every later step safer and faster.
General information only, not security advice. Generate offline, store in a manager, enable MFA on email/bank. If you lose your master password it cannot be recovered by us.