Password Generator: Frequently Asked Questions

The ToolHive generator uses the browser's crypto.getRandomValues() CSPRNG and runs entirely in your browser — nothing is sent to any server. It is as safe as generating passwords locally. For the most sensitive passwords (password manager master key), generate offline or use a dedicated local tool.

12 characters is the minimum for any account with access to sensitive data. 16 characters provides excellent protection. 20+ characters is ideal for anything stored in a password manager where you never need to type it. Length matters more than complexity.

The colour coding (purple=uppercase, green=lowercase, orange=numbers, pink=symbols) lets you verify at a glance that the password contains the character types you selected and see the approximate distribution. It also makes the password visually easier to scan if you need to transcribe it.

Entropy measures how many bits of randomness are in a password. Each bit doubles the number of possible passwords an attacker must try. A password with 60 bits of entropy requires 2^60 ≈ 1 quintillion guesses to guarantee cracking. At 10 billion guesses per second (modern GPU), that is about 3 years. 80 bits takes 3,700 years.

Symbols increase entropy significantly and should be included whenever the site allows them. However, increasing length by 4 characters gives more entropy than adding symbols to a shorter password. If a site rejects symbols, add length instead.

Never. Generate a unique password for every account. Reusing passwords means a single breach can compromise all your accounts. A password manager makes unique passwords per site practical.

Copy it immediately to your password manager. Do not write it on paper or in a text file. If you must write it down temporarily, shred the paper afterwards. Never store passwords in plain text files, browser bookmarks, or email drafts.

Marginally — guaranteed composition reduces the theoretical entropy very slightly (by about 2–3 bits for a 16-character password). In practice this is negligible. The convenience of meeting composition requirements far outweighs the fractional entropy reduction.