Before you start
- Check the official service’s minimum and maximum length and accepted characters.
- Generate a different password for this account within those limits.
- Save it in your manager with the correct domain and username.
- Complete the change in the service; this generator does not change your account.
Length and randomness come first
First check the service’s length limits and accepted characters. This generator defaults to 20 random characters: a product choice, not a universal NIST requirement. NIST distinguishes passwords used alone and with another factor; the service may have a different policy.
Predictable substitutions such as replacing E with 3, adding 123, or appending the current year do not turn a familiar word into a strong password. Attackers test those variations automatically.
- Prefer cryptographically random generation.
- Avoid names, dates, teams, addresses, and familiar quotations.
- Do not shorten a password only to make it easier to type.
Choose, generate, store and verify
- Check the official service’s minimum and maximum length and accepted characters.
- Generate a different password for this account within those limits.
- Save it in your manager with the correct domain and username.
- Complete the change in the service; this generator does not change your account.
- Test the new sign-in and check recovery email, phone and codes before ending your old session.
Every account needs a unique password
Even an excellent password loses its value when reused. After a breach, criminals automatically test exposed credentials against email, social networks, and stores. A password manager solves the practical problem by creating and storing a different credential for every account.
Protect your primary email especially well because it is often the recovery key for other services.
Add another layer of protection
If your account uses a password, enable the service’s multi-factor authentication. Prefer phishing-resistant options where available; follow its instructions to configure an authenticator app or security key.
If the service offers passkeys, they can replace the password in that flow. Their operation depends on the authenticator and user verification; do not treat every passkey as a separate second factor.
A PIN is not the same as a password
A short PIN is appropriate only when a device or service limits attempts and protects the secret locally. Do not use a six- or eight-digit PIN as an unrestricted online password. Avoid sequences, birthdays, and repeated digits.
When to change and what to check
Change after suspected compromise, a breach, reuse or a justified service requirement. Periodic changes without evidence of risk do not replace other protections.
After changing it, test sign-in, end unknown sessions and review recovery options.
Strong password FAQ
What is the recommended minimum length?
First check the service’s length limits and accepted characters. This generator defaults to 20 random characters: a product choice, not a universal NIST requirement. NIST distinguishes passwords used alone and with another factor; the service may have a different policy.
Must I change my password every month?
Not without a reason. Change it after a suspected compromise, breach, reuse, or a specific service warning.
Can I write a password down?
A physical note kept in a private place can be safer than reuse. For many accounts, prefer a password manager protected by a strong master password and a second factor.