Password Generator
Pick a length and the character sets you want, and get a password drawn from the browser's cryptographic random number generator. Nothing is sent to any server and nothing is stored.
Length is the setting that matters, and it is not close
- Each character multiplies the search space; each character set multiplies the alphabet once. A 20-character lowercase password is drawn from a far larger space than a 12-character one using all four sets. Sixteen is a sensible floor.
- Symbols are off by default for operational reasons. A TACACS+ secret pasted into a vendor web UI, a password in a connection string, a shell where
$and!belong to the shell, an appliance that truncates at sixteen. Length never causes an outage at 2am. - The strength bar counts length and character classes, nothing else. Fair for a password this page generated, because it knows the password was random. Meaningless for one a human invented:
Password1!scores the same and is in every cracking dictionary.
A good password is not the control you think it is
Almost no account compromise you work on will involve anybody guessing a password. It will be a password reused on a site that was breached, one typed into a convincing fake login page, or a session cookie stolen after a successful login — and a 40-character random string defends against none of the three.
What stops them is a second factor, a manager that only autofills on the real domain, and unique credentials per service. The harder half is infrastructure credentials: the shared enable secret in every switch, the service account unchanged since the cluster was built. Those are inventory problems, not generator ones.
When to use something else
To find the credentials already committed to a repository or sitting in a config file, secrets-scanner is the tool, and config-redactor strips them consistently out of a device configuration before you paste it anywhere.
For directory hygiene at scale — stale accounts, unconstrained delegation, password policy that does not do what it says — active-directory-auditor and the active-directory-security skill cover the ground this page cannot. On network devices specifically, network-aaa-command-authorization is the answer to shared local passwords.