Password generator

Length matters far more than forcing in symbols. Anything under 12 characters falls quickly to modern hardware; at 16 or more it is out of reach in practice. And however good a password is, reusing it means one leaked site exposes all the others. Use a different one everywhere, do not try to memorise them, and keep them in a password manager.

The arithmetic is clear. Take a 12-character password from letters and digits (62 symbols) and add the full set of punctuation (94 symbols): the number of possibilities grows about 150 times. Keep the same 62 symbols but go to 16 characters: it grows about 15 million times. Four extra characters do roughly a hundred thousand times more work than every symbol on the keyboard.

That is not an argument against symbols. It is a warning about the most common mistake: making a password short and "fixing" it with punctuation when the site would have allowed a longer one. Make it long, let a manager remember it.

With a password generator the only question is where the value goes. This page does not ask a server to make one. It uses the cryptographic random number generator built into your browser (crypto.getRandomValues), the value is created on your device and never leaves the screen, and nothing is logged — close the tab and it is gone. When random bytes are turned into characters, modulo bias is removed so no character comes up more often than the others.