How the passwords are made
Each character is picked at random from upper and lower case letters and digits, plus symbols if
you include them. The randomness comes from your browser's cryptographically secure random number
generator (crypto.getRandomValues), the same source used for encryption keys, and every
character is equally likely. The password is created on your device and is never saved or sent
anywhere.
How long should a password be?
Length matters more than anything else. The figure under the password shows its entropy: how many guesses an attacker would need, written as a power of two. Each extra bit doubles the work.
- 16 characters (about 95 bits, or 103 with symbols) is far beyond what can be brute-forced and is a good default for accounts.
- 20 or more is a good choice for password manager master passwords, encryption keys and Wi-Fi networks.
- Leave symbols out if a site doesn't accept them, and add a few characters of length instead.
Use a different password for every account, and keep them in a password manager. To share one with someone, send it in a self-destructing encrypted paste rather than in plain chat or email.