How to use it
- 1A new password appears as soon as the page loads.
- 2Set the length – 16 characters or more is a good default – and choose which characters to include.
- 3Turn on “Avoid look-alike characters” if you’ll have to read or type the password by hand.
- 4Click Copy and paste the password into the sign-up form or your password manager.
What makes a password strong?
Length matters most. Every extra character multiplies the number of possible passwords, so a random 16-character password is vastly harder to guess than a clever 8-character one. Mixing lowercase and uppercase letters, numbers and symbols helps too, because it enlarges the set of characters each position can take.
Randomness is the other half. People are predictable – words, names, dates and keyboard patterns are the first things cracking tools try. A password picked by a secure random generator has no pattern to exploit.
How this generator works
Passwords are created in your browser with the Web Crypto API (crypto.getRandomValues), the same source of randomness used for encryption keys. Each character is chosen with rejection sampling, so no character is more likely than another, and at least one character from every group you selected is included.
Nothing you generate is sent to nestoo or stored anywhere. Close the tab and the passwords are gone – so copy them into a password manager first.
What the entropy number means
Entropy measures how many guesses an attacker would need, in bits: each extra bit doubles the work. Around 60 bits resists online guessing, 80 bits and more is strong even against offline cracking of a leaked database, and 100+ bits is overkill for almost any account.
Questions and answers
How long should my password be?
Use at least 12 characters for everyday accounts and 16 or more for email, banking and your password manager’s master password. If a site allows it, longer is always better.
Is it safe to generate a password online?
Here, yes: the password is generated locally in your browser and never leaves your device. You can even disconnect from the internet after the page loads and the generator keeps working.
Should I use a different password for every site?
Yes. When one site is breached, attackers try the leaked email and password combinations on other sites. Unique passwords for every account stop that – and a password manager makes them easy to keep.
Why avoid look-alike characters?
Characters like capital I, lowercase l and the number 1, or O and 0, are easy to confuse when you read a password aloud or type it from paper. Excluding them makes the password slightly shorter in entropy but much easier to handle.