Every account needs a unique password — no exceptions
Password reuse is the single biggest threat to online security. When a service is breached (and breaches happen constantly — check haveibeenpwned.com for your email), attackers take the leaked password and try it on email, banking, social media, and every other service. This is called credential stuffing and it is automated. A unique password per account means a breach at one site cannot compromise any other account.
Use a password manager — it changes everything
The only realistic way to have unique, strong passwords for every account is to use a password manager. You remember one master passphrase; the manager generates and stores unique random passwords for every site. Good free options include Bitwarden (open source, highly audited) and KeePass (offline, open source). The ToolHive generator is ideal for the rare cases when you are not at your password manager — a public computer, a shared device, or onboarding a colleague.
When sites reject your generated password
Some sites have counterproductive password policies — maximum length limits (often 16 or 20 characters), restrictions on which symbols are allowed, or requirements for specific patterns. For length-limited sites, use the slider to match the maximum length. For symbol restrictions, uncheck the symbols option and increase length to compensate. Never sacrifice length for symbol inclusion — a 20-character lowercase-only password is stronger than a 10-character mixed password.
Generate multiple and choose the one that feels right
If you ever need to remember a password (for a computer login or password manager master key), generate 5–10 passwords and pick the one your eye catches most naturally. Some combinations of characters happen to form near-memorable sequences by chance. Choosing the most memorable from a set of equally random passwords does not compromise security — they are all equally random.
The "require at least one of each" option
Some sites require that a password contain at least one uppercase, one number, and one symbol. Enabling this option guarantees the generated password satisfies these rules immediately. Without it, a purely random selection might occasionally produce a password with no symbols by chance — statistically unlikely for long passwords but possible. Enable it when you know the site has composition requirements.