Practical Tips and Common Mistakes When Using a Strong Password Generator
Reviewed by the FreeOnline.fyi team · Updated 2026-09-09
Most password generators look the same on the surface: a slider, a few checkboxe
Most password generators look the same on the surface: a slider, a few checkboxes, a copy button. The differences that matter are invisible — what randomness source they use, whether the result ever touches a server, and whether the strength meter is honest. We built Password Generator Strong around three principles: everything runs in your browser via the WebCrypto API, no result ever leaves the page, and the numbers shown are derived from the actual charset and length you selected rather than a marketing curve. That last point is the one most users underestimate, and it's where the practical tips below start.
Length beats almost every other lever. A 20-character password drawn from the 95 printable ASCII characters carries roughly 131 bits of entropy (log2(95^20)), which against an offline attacker guessing 10 billion hashes per second is a non-event in any human timescale. Bump that down to 12 characters and you're at about 78 bits — still strong against realistic attackers, but the margin for a future hardware improvement shrinks fast. When we ship the generator, the default is 20 characters with all four character classes on, because the marginal inconvenience of typing a 20-character string once (into a password manager) is essentially zero compared with the cost of a reused or short password. You can drag the slider lower for throwaway accounts, but for anything tied to email or banking, treat 16 as the floor.
The mistakes we see most often are not exotic.
The mistakes we see most often are not exotic. Reusing passwords across sites is still the dominant cause of account compromise, because a single breach at a low-stakes forum becomes a credential-stuffing key for your bank. A second classic is "I'll just swap O for 0 and add an exclamation mark" — those rules are well known to every cracking dictionary, so a password like `Tr0ub4dor&3` looks complex but sits at roughly 28 bits of real entropy. A third is enabling the "exclude ambiguous" option without thinking: removing 0/O/1/l/I is great for readability on a printed label, but it shrinks your charset by about 7% and slightly reduces entropy each time. Use it only when you genuinely need to read the password off the screen.
The strength meter and crack-time estimate on the Password Generator Strong page are derived live from your settings, not a lookup table. The crack-time assumes 10 billion guesses per second against a stolen hash, which is roughly what a modern GPU rig can do against a fast hash like NTLM. That's a worst-case scenario — a live login form will throttle the attacker to dozens of attempts per second, which is why the meter says "centuries" even for passwords that look unremarkable. The honest reading is: the meter is calibrated against offline attacks, so "Strong" means strong even if your hash leaks. "Excellent" just means you have headroom for hash algorithms we don't fully know yet.
Pair the generator with a password manager rather than your browser's built-in s
Pair the generator with a password manager rather than your browser's built-in save. Browser autofill is convenient, but it ties your credentials to a single device profile and a single browser vendor; a dedicated manager is portable, supports per-entry notes and 2FA seeds, and lets you actually use 20-plus-character random strings because you never have to type them again. The realistic workflow we recommend: open the generator, set length to 20+, leave the four character checkboxes on, copy the result, paste it into your manager as a new entry, then enable two-factor authentication on the site itself. That's the full loop, and it takes about thirty seconds.
A quick checklist before you click Generate: confirm the length is at least 16 for any account that matters; keep symbols and digits on unless the site rejects them (which is increasingly rare under modern NIST SP 800-63B guidance); only flip "exclude ambiguous" on when you'll be retyping the string by hand; and never edit the result yourself — every character you add or remove from a random string does more harm than good to the entropy you just paid for. If you want to explore more no-account, client-side tools alongside this one, the FreeOnline.fyi free online tools hub indexes the rest of the collection so you can find the next utility without signing in anywhere.