Length is the setting that matters
This password generator draws each character from your browser's cryptographic random source, and the only knob that really changes the answer is the length. Every character added to a 94-character alphabet multiplies the search space by 94, which is a little more than six and a half bits. Turning on symbols for a password that stays at eight characters buys about seven bits in total; adding four characters instead buys twenty-six.
This is why the familiar advice — one capital, one number, one symbol — aged so badly. It was
written for an era of eight-character limits, it pushed everyone towards the same predictable
substitutions, and it produced P@ssw0rd1 in vast numbers. NIST dropped the composition rules from
its guidance years ago and told sites to accept long passwords instead. If you have to choose one
setting here, choose length.
Passphrases, and the arithmetic behind them
The word mode strings together entries from a fixed list of ordinary English words. Each word contributes the base-two logarithm of the list size, so a 335-word list gives a little over eight bits per word. Five words is around 41 bits; add the optional two-digit suffix and you gain another 6.6.
That is less than people assume, and it is worth being blunt about it: a passphrase is not automatically stronger than a random string, it is easier to type. Where it earns its place is on devices with no keyboard worth the name — a smart television, a console, a router's setup screen — and as the master password of a manager, which is the one secret you must remember rather than store.
The words are separated by a character you choose, and the separator is not a security feature. Neither is capitalising the first letter. Both exist because some sites still refuse a password that lacks an uppercase letter, and refusing to bend to that means not being able to sign up.
What the strength label is not
The label and the guessing time on this page describe the recipe you selected, not the string that came out of it. A generator cannot tell you that the random draw happened to produce something a dictionary attack would find, because with a uniform draw from a large alphabet that outcome is vanishingly unlikely — and if it did happen, the next draw is exactly as likely to be "bad". Reroll if a password is awkward to type. Do not reroll because it looks weak.
What the figure genuinely depends on is the defender, not you. The same password takes seconds against an unsalted MD5 dump and centuries against Argon2. You have no control over that choice, so the sensible move is to assume the worst and buy margin with length.
Then put it somewhere you will not lose it
A generated password you retype from memory is a password you will reuse, and reuse is the failure that actually empties accounts. Use a manager — the one in your browser counts — and let it hold a different secret for every site. Reserve your own memory for the master password and for the handful of credentials you type on devices a manager cannot reach.
Two habits finish the job. Turn on two-factor authentication wherever it is offered, because it survives a leaked password. And change a password only when there is a reason to, since forced rotation is the other rule modern guidance dropped: it pushes people towards small predictable edits.
Need a random identifier rather than a secret? The UUID generator produces v4 and v7 identifiers. To fingerprint a file or a string, use the hash generator, and for filler text there is the lorem ipsum generator.