Question 1

How long should my password actually be?

Accepted Answer

For most accounts, 16 characters is a fine baseline. For anything important — your email, password manager master password, banking — go 20+. Length matters more than symbol mix: a 20-character password with just letters and numbers is harder to crack than a 10-character one with every symbol on the keyboard.

Question 2

Is the password generated locally on my device?

Accepted Answer

Yes. It's produced in your browser using crypto.getRandomValues, which is the same cryptographic RNG browsers use for secure connections. Nothing gets sent to a server, nothing gets logged, and no two generations produce the same output — what appears on your screen exists only there.

Question 3

Should I include symbols?

Accepted Answer

If the site accepts them, yes — they widen the character set and make brute-forcing slower. But if you're forced to choose between 'shorter with symbols' and 'longer without', pick longer every time. A password manager handles the copy-paste either way.

Question 4

Is it safer than the password suggestions my browser makes?

Accepted Answer

Roughly equivalent. Safari, Chrome, and 1Password all use the same kind of cryptographic RNG. The main reason to use a standalone generator is when you need to follow a specific policy (exact length, no ambiguous characters, certain symbols excluded) that the built-in suggester can't match.

Question 5

Can I trust that the password isn't saved somewhere?

Accepted Answer

Yes — there's no backend to save it to. The generator is a static page that runs JavaScript in your browser. You can even open the network tab in dev tools and confirm nothing leaves the page after the initial load.

Password Generator

What is Password Generator?

Related tools