Most advice about passwords is outdated. Swapping an a for @ doesn't help much. What actually matters is length and randomness — and the easiest way to get both is to generate the password instead of inventing it.
Length beats complexity
Every extra character multiplies the number of possibilities an attacker has to try. A random 16-character password is astronomically harder to crack than a clever 8-character one. Aim for at least 16 characters wherever the site allows it.
Randomness matters
Humans are terrible at being random — we reuse patterns, names and dates. A generator uses your browser's cryptographic random source (crypto.getRandomValues) to produce genuinely unpredictable passwords.
How to generate one
Open the Password Generator, set the length (16+), toggle uppercase, numbers and symbols, and click Generate. It runs entirely in your browser — the password is never sent anywhere — then copy it straight into your password manager.
Three rules that matter more than "complexity"
- Use a unique password per site. A breach on one site shouldn't unlock the others.
- Use a password manager so length and uniqueness cost you nothing.
- Turn on two-factor authentication wherever it's offered.
Do those three and you're ahead of almost everyone.