Password reuse is the actual mechanism behind most account takeovers: one breached forum leaks your email and password, and automated tools try that pair on every major site within minutes. A unique, random password per account breaks that chain completely — the leaked password works nowhere else. Human brains cannot invent or remember dozens of such passwords, which is precisely why a generator exists: it produces strings with enough entropy that guessing is infeasible, and a password manager remembers them so you do not have to. Length beats complexity every time — a 20-character password drawn from any decent character set outlives an 8-character puzzle of symbols you can barely type.
Length beats complexity
Each added character multiplies the guessing space by the size of the character set, so going from 12 to 20 characters matters far more than swapping letters for symbols. A 20-character password of plain lowercase letters already resists offline guessing for longer than any realistic adversary budget. Complexity rules — mandatory symbols, forced rotations — mostly produce passwords that are harder for humans and barely harder for machines. When a site forces complexity, comply; otherwise just make it long.
Passphrases: secure and typable
Five or six random words strung together give you roughly the same guessing resistance as a long random string, with the advantage that you can actually type and read them over the phone. The critical word is random: a meaningful sentence from a book or lyric is guessable, five words drawn by a generator are not. Use passphrases for the few passwords you must memorize — your password manager's master password, your disk encryption — and random strings for everything else.
Generate, then store — never memorize
A generated password you try to memorize will be weakened by memorization: you will shorten it, pattern it, or reuse it. The workflow that works is generator plus manager — generate 20+ random characters, save them in a reputable password manager, and let autofill do the typing. Enable two-factor authentication on important accounts as well; a password, however strong, is still a single factor.
How to use
- Choose a length of at least 16 characters — 20 or more for important accounts.
- Include uppercase, lowercase, digits, and symbols unless the site restricts them.
- Generate, then save the result directly in your password manager.
- Never reuse it anywhere else.
Frequently asked questions
Are generated passwords really random?
Reputable generators use the operating system's cryptographic random source, which is unpredictable. Avoid generators that cannot explain their randomness source.
Should I change passwords regularly?
No — scheduled rotation is outdated advice. Change a password when there is reason to believe it leaked, and otherwise leave a strong unique one alone.
What about the passwords I must memorize?
Use a passphrase of five or more random words for the two or three you truly need in your head. Everything else lives in the manager.
Is a password manager itself safe?
Yes, provided you pick a reputable one with a strong master passphrase and two-factor authentication. One well-defended vault beats dozens of reused passwords.