How to Generate Secure Passwords

Problem

You need a strong password that is resistant to brute force and meets complexity requirements.

Prerequisites

• Understanding of password strength
• Knowledge of character sets

Steps

1. 1. Set the password parameters

   Choose a length (at least 12 characters; 16+ recommended). Select character sets to include: lowercase, uppercase, digits, and symbols. Longer passwords are stronger than complex short ones. Avoid ambiguous characters (O, 0, I, l) if the password must be transcribed.

   Input

   length: 16, all character sets

   Output

   parameters set

2. 2. Generate the password

   Generate the password using a cryptographically secure random number generator. For each character, randomly select from the chosen character sets. Ensure at least one character from each selected set is included. The generation must use a CSPRNG, not Math.random.

   Input

   16 chars, all sets

   Output

   K7#m@xL2!pQ9$vNw

3. 3. Evaluate strength and use

   Check the password meets your requirements (length, character types). Estimate entropy: each character adds log2(charset_size) bits. A 16-character password with 94 possible characters has about 105 bits of entropy. Use the password immediately or store it in a password manager.

   Input

   K7#m@xL2!pQ9$vNw

   Output

   entropy: ~105 bits, very strong

Expected result

A strong, random password that meets the specified complexity and length requirements.

Common errors

Using Math.random for password generation

Math.random is not cryptographically secure. Use crypto.getRandomValues or a dedicated secure generator.

Excluding symbols to make it memorable

Length matters more than complexity. A 20-character lowercase password is stronger than an 8-character complex one. Prioritize length.

Troubleshooting

• If the password is rejected by a service, check its specific requirements (some disallow certain symbols).
• Generate a new password if you need to exclude specific characters.

Security limits

• Generated passwords stay in your browser. No password is transmitted or stored remotely.
• Use a password manager to store generated passwords securely.