How to Generate a Strong Password in the Browser

DevOkk’s Password Generator runs in the tab. No account. The useful controls are length and character classes, not a theme or a mascot.

What “strong” actually means

Strength here is guessability, not a vibe. Attackers try leaked lists, then common patterns (Summer2024!), then brute force against a short alphabet. A 16-character string drawn uniformly from mixed classes is expensive to guess. P@ssw0rd is not, no matter how many composition rules it satisfies.

Composition rules (one upper, one digit, one symbol) exist because old policies cargo-culted them. They do not rescue an eight-character password. They also do not require you to invent the string yourself. Let a CSPRNG pick, then satisfy the form.

Uniqueness is the other half. A 20-character random password reused on three sites is one breach away from being a skeleton key. Generate per account. That is a storage problem, which is why a generator without a manager is only step one.

Length beats clever substitutions

People shorten passwords so they can type them. Then they add ! at the end and feel finished. The math goes the other way. Extra characters multiply the search space. A symbol in a predictable slot does not.

Practical defaults that survive most signup forms:

• Length 16 as a floor, 20 if the site allows it.
• Upper, lower, digits, and symbols on, unless the site rejects a class.
• If the site rejects symbols, keep length and drop symbols. Do not drop to 8 characters and add 1!.

Passphrases (four or five unguessable words) can be strong if the words are not a quote and not a keyboard walk. They are harder to generate well in a small widget. For site passwords you will paste from a manager, a random character string is simpler.

Why generate in the browser

A generator that runs on a server has to create the secret on that server, even briefly. You are trusting their logs, their support tools, and whoever else can read the process. You do not need that trust for “give me 16 random characters.”

The browser already has crypto.getRandomValues. DevOkk uses it, with rejection sampling so the charset is not biased by a naive modulo. That is the correct shape for this job.

The page still loads over the network. Analytics may still fire. The distinction is the password itself: it is minted in the tab, not requested from an application server as the result of the click.

If your policy forbids any web page for production credentials, use the generator in your password manager instead. This guide is for the case where you need a string now and you do not want to invent it.

Settings that actually change the outcome

Length. The slider that matters. Move it before you touch anything else.

Character classes. At least three of the four (upper, lower, number, symbol) for most sites. All four when the form allows it.

Exclude similar. Drops i, l, 1, L, o, 0, O. Use this when a human will read the password off a screen and type it - a Wi-Fi card, a console, a colleague on a call. Skip it when a manager will paste.

Exclude ambiguous. Drops punctuation that some forms or shells treat as syntax. Use it when you have been burned by { in a config file. Do not enable every exclusion at once on an eight-character password. You will shrink the alphabet and then wonder why the strength meter looks sad.

Generate once. If the site rejects the string, change one constraint and generate again. Do not edit the output by hand to “make it memorable.” That is how xK9! becomes xK9!Love.

After you generate: store it, then leave

Copy from the tool into the password manager you already use. Name the item after the site, not after the mood you were in. Enable 2FA on the account if it exists. Then close the generator tab.

Do not:

• Paste the new password into email or chat “so you have a copy.”
• Save it in a notes app that syncs in plaintext.
• Reuse it because the next form is “just a throwaway.”

If you want a second opinion on guessability, paste it into Password Strength Checker on the same site, still in the browser. A green estimate is not a breach-database search. It is a check that you did not accidentally generate something short or patterned.

On a shared computer, do not leave the generated string visible. Clipboard history is a separate problem; clear it if the machine is not yours.

What a generator is not

It is not a password manager. It will not sync to your phone, fill the login form, or rotate the secret next quarter.

It is not a breach monitor. It does not know whether a similar string appeared in a dump.

It is not encryption for files. If you are about to email a PDF and you are thinking about passwords, that is a different workflow: encrypt with a tool you trust, send the password out of band, and still strip metadata if the document should not advertise the author. See the privacy checklist for the file side.

It also will not save you from phishing. A strong unique password typed into a fake site is still gone. Look at the origin bar.

Generate once, store it, never invent it

Open Password Generator, set length to at least 16, generate, and store the result in a manager. If you are instead trying to decide whether an existing password is a bad idea, use Password Strength Checker and read How to Check Password Strength.

Generate per account. That is the habit. The widget is just how you avoid inventing the string yourself.