Why generated passwords are stronger
Attackers do not guess your password by hand; software tries millions of combinations per second. Human-chosen passwords fall to dictionary lists and patterns. A random string of sufficient length defeats both, because there is no pattern to exploit. The generator is the cheapest security upgrade you will ever make.
The math: every extra character multiplies everything
Security practitioners measure password strength in bits of entropy, and the formula is short: bits = length × log2(charset size). If a password draws from letters and digits only — 26 lowercase plus 26 uppercase plus 10 digits, a 62-character alphabet — each position contributes log2(62) ≈ 5.95 bits.
Run the numbers:
- 8 random alphanumeric characters: 8 × 5.95 ≈ 47.6 bits. The full search space is 2^47.6, roughly 213 trillion guesses. At 100 billion guesses per second — ordinary for a modern GPU rig against fast hashes — the entire space falls in about 35 minutes, and on average the crack takes half that.
- 16 random alphanumeric characters: 16 × 5.95 ≈ 95.3 bits. The search space grows to roughly 5 × 10^28 guesses. At the same attack speed, an exhaustive search would run for tens of billions of years. This is the distance between "an afternoon" and "heat death of the universe."
- 6 random words (a passphrase): about 77.5 bits from a 7,776-word list — human-memorable and still far beyond practical attack. More on this below.
The mental model that matters: every character you add multiplies the attacker's workload by 62. Every character you remove divides it. "Length beats complexity" is not a slogan; it is arithmetic.
How cracking actually happens
An offline attack starts with stolen data. When a site's database leaks, attackers get password hashes — one-way transformations — and then guess offline at full hardware speed, with no rate limiting and no lockouts. Tools like hashcat on a rig of eight GPUs try billions of candidates per second against fast, unsalted hashes such as MD5 or Windows NTLM. Well-built sites store passwords under deliberately slow hashes (bcrypt, scrypt, Argon2) that throttle the same rig to thousands of guesses per second — but you cannot inspect how a site hashes your password, so assume the worst.
The fuel for those guesses is real breach data. The 2009 RockYou breach produced a list of roughly 14 million distinct passwords that became the canonical cracking dictionary — rockyou.txt ships with every major cracking tool today. Attackers then apply "mangling rules" to it: capitalize, append a year, swap a for @, o for 0. Every substitution humans believe is clever already exists as a standard rule in the attacker's toolkit. P@ssw0rd! is not a riddle; it is a line item.
And reuse is the real killer. When any site you use gets breached, your email and password land in a corpus that bots replay against hundreds of other login forms — banks, email providers, cloud storage. This is credential stuffing, and it works precisely because one reused password connects one leak to every account behind it. Randomness defeats the dictionary attack; uniqueness defeats the stuffing attack — you need both, which is why a generator plus a manager is the actual fix.
What makes a password strong
- Length beats complexity. A 16-character random string is stronger than a short "complex" one stuffed with symbols — see the math above.
- Randomness. No names, dates, or words a dictionary contains, in any spelling.
- Uniqueness. A different password for every account, so one leak does not unlock many.
- Secrecy. Never shared over chat or written where others can see.
What NIST actually recommends
The US National Institute of Standards and Technology settled much of this in its SP 800-63B digital identity guidelines (first published in 2017, revised since), and the recommendations surprised people: a minimum of 8 characters, support up to at least 64, no forced special characters, no periodic rotation unless there is evidence of compromise, and automatic screening against breached-password lists.
Why the reversal? Because composition rules and forced rotation push users toward predictable patterns. Force "one number, one symbol, change every 90 days" and humans produce Summer2026! in July and Summer2027! in October — trivially predictable increments that pass every rule on the books. NIST concluded that a long, random, unique password never rotated does more for security than a short complex one changed on a schedule. If a bank still forces quarterly rotation with a symbol requirement, that is legacy policy, not current guidance.
Passphrases: long and memorable beats short and gibberish
The one password a human genuinely should hold in memory is the one that unlocks everything else — the password manager itself. The classic answer is a passphrase built from randomly selected words: the diceware method, published by Arnold Reinhold in 1995, rolls five dice per word, and the EFF's large wordlist (released in 2016) supplies 7,776 words for exactly this purpose. Each random word contributes log2(7,776) ≈ 12.9 bits, so six random words deliver about 77.5 bits — enough to outlast any realistic attack, and memorable because the words form a strange, sticky image: vault-copper-lantern-drift-mango-quilt.
Two cautions. First, the words must be genuinely random: song lyrics, famous quotes, and movie lines live in dictionaries too. Second, the passphrase only protects the master key. Everything else should be a generated random string you never need to recall, stored in the manager.
Why "no signup" matters
A password generator that asks you to register is asking you to trust it with the very secrets it creates. A no-signup, browser-based generator produces the password on the page and never sends it anywhere. There is no account to breach and no copy stored on a server.
The test to apply to any generator, free or paid: does the password ever leave your device? If a service can show you a password you generated last week, that string sits in a database somewhere in readable form. The same instinct flags any website that emails you your current password — a site can only do that if it stores credentials in a reversible form, which means it was never hashing them properly. A real generator has one job: create a random string locally and forget it. Everything that requires remembering belongs to the manager, not the generator.
How to use it
- Open the password generator and choose a length of at least 16 characters — more if the site allows it.
- Include mixed cases, numbers, and symbols unless a site forbids them.
- Copy the result straight into a new password manager entry and save.
- Paste from the manager into the site's signup form. Never retype it, and never keep the copy in an email or a note.
- Move on — the manager remembers so you do not have to.
Pair it with a manager
Password managers — Bitwarden, 1Password, KeePass; free options exist at every tier — include built-in generators driven by the OS cryptographic random source. The division of labor is simple: the generator creates, the manager stores. What you must never do is generate a strong password and then weaken it to memorize it. That undoes the entire exercise.
A worked example
Weak: "Summer2026!" — a common word, a four-digit year, one symbol. It passes most composition rules, which is exactly why it is worthless: attackers apply the same rules. Capitalized word plus year plus symbol is a standard mangling pattern, so this string effectively exists inside rule-expanded dictionaries. An attacker who suspects the pattern needs only a few million variants — seconds of GPU time.
Strong: "k7Qm#2vLp!wX9zRb" — sixteen random characters drawn from the full printable set of roughly 94 symbols, about 6.55 bits each. That is approximately 104.8 bits of entropy. No rule expansion helps, because there is no rule to discover. Even knowing the exact length and character set, an exhaustive search is not a hard project; it is an impossible one.
The difference is not cleverness; it is randomness and length. The strong example is harder to say out loud — fine, because you are never supposed to say it out loud. It lives in the manager.
To make the contrast concrete:
- Dictionary word + year + symbol: predictable pattern, covered by standard cracking rules, falls in seconds once the pattern is suspected.
- Name + birthday: personal data sitting in public records and social feeds; effectively pre-solved for the attacker.
- Random 16 characters: no pattern to exploit; attack cost measured in geological time. Use this.
Beyond the password
A generator solves one problem. Pair it with a password manager so you never have to remember or reuse, and turn on multi-factor authentication everywhere it is offered. A password is one lock; MFA is two.
Honest limits: a random password cannot save a phished account. If you type a flawless 20-character random string into a convincing fake login page, the attacker receives that flawless string. Phishing defeats the password, not the randomness. This is why MFA matters more than any password improvement — a code from your phone is worthless to someone who stole only your password. For sharing a one-off secret or a guest WiFi passphrase, generate a fresh string each time and retire it when the need ends.
Free vs paid generators
Free generators produce strong random passwords, and generation itself is commodity math — all correct implementations produce the same quality of randomness. Paid tools add cross-device sync, breach alerts, and secure sharing, but those are manager features, not generator features. When a paid "security suite" advertises better passwords than a free generator, it is usually bundling the creation step with the storage step. Creation is the part that should be free, local, and unmonetized.
Common mistakes
- Reusing a strong password. Randomness does not forgive reuse. One breach exposes every account sharing the string, and credential stuffing does not care how strong the password was.
- Storing in plaintext. A generated password saved in a text file, spreadsheet, or email draft recreates the problem in a new location. Use a manager.
- Assuming "complex" means safe. Eight characters across a 94-symbol set is about 52 bits — hours of GPU time, not years. Length is the multiplier that matters.
- Rotating good passwords on a calendar. Forced quarterly changes produce predictable increments like Summer2026! becoming Summer2027!. Change on evidence of compromise, not on a schedule.
- Retyping from memory. Hand-transcribed passwords drift as you invent shortcuts to type them, and every shortcut leaks entropy.
Who should use it (and who shouldn't)
Everyone with an online account should use a generator for new passwords — the upgrade costs seconds and the math points one direction. The only exception is a rare site with a short maximum length; there, use the longest random string allowed — and if it accepts spaces, a random passphrase squeezes more entropy into the same budget. What nobody should do is generate a password and then sand it down to something memorable. If you can remember it without a system, an attacker's rules can reconstruct it.
How it fits a privacy toolkit
Glint's password generator is free, requires no signup, and runs entirely in your browser. Use it for new accounts, API keys, and shared secrets. For auditing existing credentials, see the strong password generator guide and how to check password strength. Developers scaffolding config files with random tokens can pair it with the JSON formatter — generate the key, paste it in, format, ship.
A quick scenario: set up a new account safely
You are signing up for a new design tool. The form asks for a password. Instead of reusing your email password with "2026!" tacked on, you open the generator, set it to sixteen characters, and copy the result into a password manager.
Two things just happened. First, that password is random, so a leak of the design tool reveals nothing about your other accounts — the stuffing bots get nothing they can replay. Second, because the manager stores it, you never have to type or remember it — no sticky note, no reuse, no drift from retyping.
Now the tool offers two-factor authentication. You turn it on. Even if that random password were somehow exposed, the second factor blocks the login. That is the layered setup a generator enables: unique password plus manager plus MFA.
Apply the same pattern to shared secrets. Need a one-time link password for a contractor? Generate a fresh string, share it over a different channel than the link, and expire it when the job ends. Need an API key for a script? Generate it, store it in the manager, and never paste it into a chat where it becomes part of tomorrow's leaked corpus. The generator is the first step in a habits chain that turns "secure by default" into practice.
Frequently asked questions
Is a no-signup password generator safe? A browser-based generator creates the password on the page and does not upload it, so nothing leaves your device. No account means nothing stored to breach. The honest caveat: a local generator cannot protect a phished account — typing the password into a fake login page hands it over, which is why MFA matters more.
How long should my password be? At least 16 random characters for important accounts — going from 8 to 16 characters is roughly 47.6 bits versus 95.3 bits of entropy, the difference between a minutes-long crack and an astronomically long one. Longer is fine wherever a site allows it.
Should I include symbols? Yes when allowed, but prioritize length. A long random passphrase is stronger than a short one packed with symbols. Note that NIST SP 800-63B dropped mandatory special-character rules precisely because they push people toward predictable patterns like P@ssw0rd!, which crackers expand for automatically.
How do I remember generated passwords? You do not — store them in a password manager. The one exception is the manager's master password: use a random six-word passphrase (about 77.5 bits from the EFF 7,776-word list), which is memorable precisely because the words are randomly paired.
Is the Glint password generator really free with no account? Yes. It is free to use and requires no signup; generation happens in your browser, and the output is never transmitted to a server.