Generate random passwords securely

A strong password should be long, unique, and generated from an unpredictable source. Length normally matters more than clever substitutions. For most accounts, use at least 16 random characters unless the service requires a different format.

Use a password manager

Never reuse a generated password across sites. Store each one in a reputable password manager so you do not need to memorise it, and enable multi-factor authentication where available. Recovery codes should be stored separately in a safe place.

A generator used for passwords must rely on cryptographically secure randomness. Do not create important passwords from names, dates, quotations, or predictable browser scripts. If a service supports passkeys, they may offer an even simpler and phishing-resistant sign-in method.