Why people are bad at making passwords
When people invent a password, they tend to follow patterns without noticing. They start with a word or name, capitalise the first letter, add a number at the end, and maybe swap an “a” for an “@”. They draw on birthdays, pets, sports teams and keyboard runs like “qwerty”. Attackers know these habits. Guessing tools try common words and the usual substitutions first, so a password that looks complicated to a person can still be among the early guesses.
People also reuse what they come up with. A password that took effort to invent gets used on several sites, which undoes its value if any one of them is breached.
A password generator avoids both problems. It chooses characters or words using a random process rather than preference, so there is no pattern for a guessing tool to exploit.
What “random” means here
A good generator uses a source of randomness designed for security, which is a different thing from the casual randomness used in games. Reputable ones are built into password managers and operating systems. Be cautious about unknown web pages that generate passwords, since you cannot easily tell how they work or whether the result is recorded. If you use one, a built-in tool from a trusted provider is usually a safer choice.
How length and character mix matter
The strength of a random password comes from how many possibilities an attacker would have to work through. Two things control that: how many characters there are, and how many different characters each position could be.
Here is a simple comparison, counting the possible combinations for random passwords:
| Password type | Choices per position | Length | Possible combinations |
|---|---|---|---|
| Lowercase letters only | 26 | 8 | 26 to the power of 8, about 209 billion |
| Lowercase, uppercase and digits | 62 | 8 | 62 to the power of 8, about 218 trillion |
| Lowercase, uppercase and digits | 62 | 12 | 62 to the power of 12, about 3.2 sextillion |
Two lessons follow. Widening the character set helps: going from 26 to 62 options per position on an eight-character password multiplies the possibilities by roughly a thousand. But adding length helps more. Four extra characters at 62 options each multiply the total by 62 four times over, which is about 14.8 million times more combinations. Both figures are approximate, and real attackers do not always guess in simple order, but the direction is reliable: length is the most efficient way to add strength.
This holds only when the password is truly random. A twelve-character password built from a name and a year has far fewer effective possibilities than the table suggests.
Passwords versus passphrases
Some generators produce passphrases, which join several randomly chosen words, such as four or more unrelated words. They can be long yet easier to type and remember, which makes them well suited to the few passwords you must actually memorise, such as a password manager’s master password or a device login. The words must be picked randomly by a tool, not chosen by you, because a quote or phrase from a song is much easier to guess than it feels.
For accounts where you will never type the password by hand, a long string of random characters is fine, because the vault fills it in.
Practical settings
- Aim for length first. Many people use at least 16 characters for ordinary accounts and more for important ones. Check the maximum a site allows.
- Use all character types unless the site objects. Some sites reject certain symbols. If a generated password is refused, try again with fewer symbol types and make up for it with extra length.
- Avoid “look-alike” exclusions unless you need them. Some tools let you omit confusing characters such as the letter O and the digit zero. That slightly reduces possibilities but helps if you must type the password manually, and a longer length can compensate.
- Do not tweak the result. Adding your own touches, like a capital letter at the start, may reduce the randomness you wanted.
Where generated passwords should live
A strong password you cannot recall is only useful if it is stored somewhere safe. Writing 40 random passwords on a sticky note beside the monitor is not a good answer. The usual solution is a password manager, which often has a generator built in, so that you can create and save a password in one step. Some browsers and operating systems offer a similar function.
Unique passwords also limit the harm from data breaches: if one site leaks its records, the leaked password opens nothing else.
What a strong password does not do
It does not protect you if you type it into a fake page, and it does not stop malware that records keystrokes. Phishing emails are designed to get around strong passwords by asking you to hand them over. A second step, such as two-factor authentication, covers the case where a password is stolen or leaked. Where passkey sign-in is available, there is no password to generate or steal at all.
A sensible routine
Use a generator for every new account, and replace old reused passwords starting with email, finance and any service that stores payment details. Keep a short, memorable passphrase for the few things you must remember, store everything else in a vault, and turn on a second step wherever it is offered. The aim is not perfection, but removing predictable human habits from the most important logins.