Password generator

What Is a Password Generator?

A password generator creates a password for you, so you don’t have to invent one yourself. That sounds like a small convenience, but it solves a real problem: people are bad at being random. When we make up a password, we reach for names, birthdays, favourite football clubs, phone numbers, or a word with a “1” or “@” added at the end. Attackers know these habits, and their guessing tools are built around them.

A generator skips human habits entirely. It picks characters unpredictably and puts them together into a string that has no meaning, no pattern and no connection to you. The result looks like gibberish, which is exactly the point.

The generator on this page creates the password locally in your browser. According to the tool description, the generated password is not sent to this website. That matters because a password you have just created should be known only to you.

What Can You Use a Password Generator For?

Any account that asks you to create a password is a candidate. The most common uses are:

• Email accounts. Your email is the key to everything else, because password reset links usually land there. It deserves your strongest password.
• Social media accounts. Facebook, Instagram, X, TikTok and WhatsApp-linked accounts are frequent targets for takeover.
• Mobile banking and fintech apps. Where an app allows a full password rather than just a PIN, make it a strong one.
• School and university portals. Student portals hold results, personal details and sometimes payment records.
• Job application sites. Recruitment portals and professional profiles contain your CV, phone number and address.
• Online stores and business accounts. Shop dashboards, payment processors and business email need protection because money moves through them.
• Wi-Fi networks. A random password for your home or office router stops neighbours and strangers from joining uninvited.
• Writing and publishing platforms. If you publish novels, blogs or stories online, your account is your work. Losing it can mean losing years of writing.
• Shared accounts. When a team needs one login, a generated password avoids the weak, easily guessed ones people choose when in a hurry.

How to Use the Password Generator

The tool is directly above this guide. The exact buttons may change as the tool is updated, but the process is generally the same.

1. Look at the settings. Check whether you can change the password length or the types of characters used (uppercase letters, lowercase letters, numbers, symbols).
2. Choose a length. Longer is stronger. For important accounts, go longer than the default if the tool lets you.
3. Select the character types you want. Include as many types as the website you are signing up for will accept.
4. Generate the password. Click the button to create a new one. If you don’t like it, generate another. There is no limit to how many you can create.
5. Copy it. Use the copy option if available, or select the text and copy it manually.
6. Paste it straight into the account form. Paste into the sign-up or “change password” box so you never have to retype it.
7. Save it immediately. Store it in a password manager or another secure place before you close the page. A random password cannot be recalled from memory, and once you leave this page it is gone.

That last step is the one people skip. If you generate a password, use it, and forget to save it, you will end up resetting it the next time you log in.

Understanding the Results

The output is a single string of characters. It will not look like anything you could pronounce or remember, and it shouldn’t. Here is what the main settings do.

Length

Length is the most important factor. Each extra character multiplies the number of possible combinations an attacker would need to try. A 16-character random password is far harder to crack than an 8-character one, even if both use the same mix of characters.

A reasonable guide

• Under 8 characters: Too short for anything that matters.
• 8 to 11 characters: Weak by modern standards, even if random.
• 12 to 15 characters: A decent baseline for ordinary accounts.
• 16 characters or more: Better for email, banking, cloud storage and anything that unlocks other accounts.

Many security guidelines now put more weight on length than on complicated-looking rules, and that matches how password cracking actually works.

Character types

Mixing character types increases the pool the generator draws from

• Lowercase letters: a to z
• Uppercase letters: A to Z
• Numbers: 0 to 9
• Symbols: characters such as ! # $ % & * ?

A bigger pool means more possible combinations for the same length. But a long password using only letters can still be stronger than a short one stuffed with symbols. Do not trade length for complexity.

Randomness

The word “random” is doing real work here. A properly random password has no pattern for an attacker to exploit. Typing “Abubakar@2024” feels strong because it has a capital, a symbol and numbers, but it follows a familiar shape: a name, a symbol and a year. Guessing tools try exactly these shapes first. A random string like the ones this tool produces has no such shape.

Practical Examples

Example 1: A new Gmail or Yahoo account.

Aisha is setting up an email address for her university applications. She generates a password of 16 characters or more with all character types, pastes it into the sign-up form, and saves it in her phone’s password manager before finishing registration.

Example 2: A home Wi-Fi password.

Musa wants to replace the default password on his router. Wi-Fi passwords are typed on many devices, so he generates a long password without confusing symbols, writes it on a card kept at home, and enters it once on each device.

Example 3: A website’s strange rules.

A job portal rejects Halima’s generated password because it does not allow certain symbols. She returns to the generator, turns off symbols, and increases the length instead. The new password is accepted and is still very strong.

Example 4: A business account shared by staff.

A small shop owner in Kano gives two employees access to the shop’s online ordering account. Instead of using something like the shop’s name and phone number, she generates a unique password and shares it through a secure channel rather than a public group chat.

Example 5: Replacing a password that was reused.

Ibrahim realises he has used the same password on Facebook, Instagram and his email for years. He generates a different password for each, starting with the email account since it controls the others.

How to Get Better Results

• Use a different password for every account. This is more important than any other tip. If one site is breached and you reused your password, attackers will try the same email and password combination on other sites.
• Start with your most important accounts. Email first, then banking, then social media, then everything else.
• Prefer length over cleverness. If a site accepts long passwords, use them.
• Don’t edit the result to make it memorable. Changing a random password into something familiar makes it weaker.
• Generate it fresh each time. Never reuse a password you generated earlier for a new account.
• Turn on two-step verification where available. A strong password is excellent, but a second step (such as a code from an authenticator app) protects you even if the password leaks.
• Don’t send passwords in public chats. Avoid pasting them into large WhatsApp groups, email threads or screenshots.
• Change passwords after a security scare. If you suspect an account was accessed by someone else, change the password immediately from a device you trust.

Common Problems and How to Fix Them

The website says my password is not accepted

Some sites limit the symbols they accept, set a maximum length, or require certain character types. Read the rules shown on the sign-up page. Then adjust the generator settings: remove symbols, change the length, or make sure it includes at least one number or uppercase letter if the site requires them.

I can’t copy the password

If the copy button does not work, long-press (on a phone) or click and drag (on a computer) to select the password text, then use your device’s normal copy command. Make sure your browser has not blocked clipboard access.

I generated a password and forgot to save it

If you have not completed sign-up, generate a new one. If you have already used it, use the website’s “Forgot password” option to reset it, then save the new one properly this time.

The password is hard to type on my phone

Passwords with many symbols can be annoying on a small keyboard. Pasting avoids the problem. If you must type it, generate a longer password with fewer symbol types, since length protects you even without them.

The password looks the same as one I used before

True random generation will almost never produce a repeat. If you think you recognise it, you probably saw part of the pattern, which is normal. Generate again if it bothers you.

I keep getting locked out

You are probably mistyping a long random string. Use a password manager to fill it automatically instead of typing it by hand.

Using the Password Generator on a Phone

Most people in Nigeria sign up for accounts on Android phones, and the tool works fine in a mobile browser.

1. Open the page in Chrome or whichever browser you normally use.
2. Scroll to the tool and generate your password.
3. Press and hold the password to select it, then choose Copy.
4. Switch to the app or website where you are signing up and paste it into the password box.
5. Save it in your phone’s password manager so it fills in automatically in future.

A few mobile tips

• Android and iPhone both include built-in password saving through your Google or Apple account. These are convenient, but make sure your phone itself has a screen lock.
• Avoid generating passwords on a public or borrowed phone, and avoid saving them in a browser you do not own.
• If you use a cyber cafe or shared computer, never allow the browser to remember your passwords.
• Avoid taking screenshots of generated passwords. Screenshots often back up automatically to cloud storage, and many people forget they are there.

Using the Password Generator on a Computer

On a laptop or desktop, the process is quicker because copying and pasting is easier.

1. Generate the password in the tool above.
2. Copy it with the button or with Ctrl + C (Cmd + C on a Mac).
3. Paste it into the sign-up form with Ctrl + V (Cmd + V on a Mac).
4. Save it in your password manager before submitting the form.

On a computer you also have more storage options, such as a dedicated password manager extension or app. If you use a shared family computer, create your own browser profile or avoid saving passwords in the browser at all.

Privacy and Security

The tool states that it creates passwords locally in your browser and that the generated password is not sent to this website. That is the right design for this kind of tool, because a password generator has no reason to see or store what it makes.

Still, good habits matter more than any single claim

• Check the website address. Make sure you are on the real site and not a copy.
• Keep your device secure. A generated password is only safe if your phone or computer is free from malware and protected with a screen lock.
• Be careful with browser extensions. Some extensions can read page content. Install only ones you trust.
• Use a private place. Don’t generate passwords where someone could read your screen.
• Clear what you copied. Clipboard contents can stay available. Copy something harmless afterwards if you are on a shared device.

No online tool, this one included, can protect an account that is also protected by a weak recovery method. If your recovery phone number or backup email is easy for someone else to access, your strong password will not help much. Keep those details up to date too.

Why Use an Online Password Generator?

• No software to install. It works in a browser, which is helpful on phones with limited storage.
• Fast. You get a new password in seconds instead of struggling to think of one.
• Free of human patterns. The result is not based on your name, birthday or favourite words.
• Easy to repeat. You can generate a different password for every account without effort.
• Useful for people who are not technical. You do not need to understand cryptography to benefit from it.

An online generator is a good starting point. For long-term safety, pair it with a password manager so you are not relying on memory or scraps of paper.

Where to Store the Passwords You Generate

A random password is only useful if you can find it again. Here are the main options, from most recommended to least.

A password manager

A password manager stores all your passwords in an encrypted vault, protected by one strong master password. It can fill in logins automatically, which solves the problem of typing long strings on a phone. Many reputable options exist, including free ones, and Android and iPhone have built-in versions.

If you use one, make the master password long and memorable, and turn on two-step verification for the manager itself.

Your phone or browser’s built-in saving

Google Password Manager and Apple’s Keychain are convenient and sync across your devices. They are a big improvement over reusing passwords. Protect them by securing your Google or Apple account with a strong password and two-step verification.

A written note kept at home

Writing passwords in a notebook kept in a safe place is not as foolish as it sounds, especially for a person who is not very comfortable with technology. A thief on the internet cannot read a paper notebook. The risk is losing it or someone at home finding it. Do not keep it in your bag or in a visible place.

What to avoid

• Saving passwords in a notes app with no lock
• Sending them to yourself on WhatsApp or SMS
• Keeping them in a plain text file named “passwords”
• Taking screenshots
• Using the same password everywhere because it is “easier”

Passphrases versus random passwords

A passphrase is a series of unrelated words, such as four or five random words strung together. They are easier to remember and can be strong if the words are chosen randomly, not from a quote or song. Passphrases are good for things you must type from memory, such as your phone’s unlock secret, your password manager’s master password, or your computer login. For everything else, a random generated password stored in a manager is the more practical choice.

How Password Guessing Actually Works

Most people picture a hacker sitting at a keyboard, typing guesses one after another. Real attacks are rarely like that. Attackers use software that can test enormous numbers of guesses very quickly, and they usually start with the guesses most likely to succeed. These include common passwords, words from the dictionary, names, dates, keyboard patterns like “qwerty”, and combinations of these with a number or symbol on the end. Only after those run out does the software move on to trying every possible combination.

This is why a random password is so much stronger than one you invented. A human-made password, even a clever-looking one, tends to fall into one of the patterns the software tries early. A random password has no pattern, so the only option left is to try every possibility. That is where length does its work. Each character you add multiplies the number of possible passwords by the size of the character pool. If the generator draws from 62 possible characters (uppercase letters, lowercase letters and numbers), then one extra character makes the search 62 times bigger. Two extra characters make it more than three thousand times bigger. This is why a long password built from a modest character set can still beat a short one packed with symbols.

You do not need to memorise any of this to benefit from it. The practical lesson is simple: let the generator do the choosing, and give it enough length to make guessing impractical.

Why Reusing Passwords Is Dangerous Even When Each One Is Strong

Many people assume the main danger is someone guessing their password. In practice, a very common danger is that a website they signed up for years ago gets breached, and their email and password end up in a leaked list. Attackers then take that leaked pair and try it on other popular services, such as email providers, social media and shopping sites. This is often called credential stuffing, and it works because many people use the same password in several places.

A password can be long, random and perfect, and it still becomes useless the moment you use it on two sites and one of them is careless with its data. You cannot control how well every website protects its stored passwords. You can control whether a leak at one site gives anyone access to your other accounts. A unique generated password for each account contains the damage. If a small forum you joined once is breached, your email stays safe, because the forum never held your email password.

For people who have reused passwords for years, the task can feel overwhelming, so it helps to work in order. Change your main email password first, because anyone who controls your email can reset almost everything else. Next, change banking and payment-related accounts, then social media, then the rest as you come across them. You do not have to fix everything in one afternoon, but you should not leave your email on an old shared password.

Websites That Reject Your Generated Password

Sometimes you do everything right and the website still refuses the password. This usually happens because of rules built into older or poorly designed systems. Some sites cap the length at a surprisingly low number. Some refuse certain symbols, perhaps because their software mishandles them. Others insist on at least one capital letter or one number even when your password is already very long.

The right response is to adjust, not to give up and invent something weak. If symbols are rejected, turn them off and make the password longer to compensate. If a maximum length is enforced, use the maximum allowed. If the rules seem to require a particular mix, make sure your generated password contains at least one of each required type, and generate again if it does not. Avoid the temptation to edit the generated password by hand, because even a small manual change can introduce a pattern.

It is also worth noticing what a website’s rules tell you about it. A site that limits passwords to eight characters, or that emails your password back to you in plain text after you sign up or reset it, is storing passwords in a way that is not safe. That is another reason never to reuse a password there.

Passwords, Two-Step Verification and Account Recovery

A strong password protects the front door, but accounts have other doors too. The recovery options, such as a backup email address, a phone number, or security questions, can be used to get into your account without ever knowing your password. If those are weak, a strong password will not save you.

Two-step verification adds a second check after the password, usually a code from an authenticator app or a text message. Where a site offers it, turn it on for email, banking apps, social media and any account that holds money or personal documents. An authenticator app is generally a safer choice than text messages, because a text message depends on your phone number staying under your control.

That point is especially relevant in Nigeria, where phone numbers are often the main recovery method for accounts, and where people change SIM cards, lose phones, or have numbers recycled. Always keep your recovery phone number and email current. If you change numbers, update your important accounts before you stop using the old one. Be wary of anyone who asks you to read out a verification code, whether by call, SMS or chat. A common scam involves a person pretending to be a friend, a bank or a support agent, asking for a code that was just sent to your phone. That code is the key to your account, and no genuine service will ask you to share it.

Phishing: The Problem a Strong Password Cannot Solve

A generated password cannot protect you if you type it into a fake website. Phishing pages copy the look of real login screens and collect whatever you enter. They arrive through links in emails, SMS and social media messages, often claiming that your account has a problem, that you have won something, or that you need to confirm your details.

Before entering a password, look at the address in the browser. Fake sites often use addresses that are close to the real ones but slightly different, with a misspelled name or an extra word. Be careful with links received in messages, and when in doubt, open the official app or type the address yourself. A password manager helps here as well, because it normally fills in a login only on the site where the password was saved. If it refuses to fill in the password on a page that looks identical to the real one, treat that as a warning.

When a Generated Password Is Not the Best Tool

A random password is ideal for most online accounts, but there are situations where something else fits better. The first is anything you must remember and type often. Your phone’s lock, your computer login and the master password of your password manager all need to live in your head. For these, a passphrase made of several unrelated words is more practical. The words must be chosen randomly, not taken from a favourite saying, a line from a novel, a song lyric or a verse, because those are exactly the phrases attackers try.

The second case is a PIN. Many banking apps and ATM cards use short numeric codes, and a password generator is not designed for those, because a short numeric code is easy to guess regardless of how it was chosen. What you can do is avoid the obvious choices, such as birth years, phone number endings, repeated digits and simple sequences, and keep the card or app locked so that a wrong guess has a real cost.

The third case is where passwords are being phased out. Some services now support passkeys, which let you sign in with your fingerprint, face or device screen lock instead of typing anything. If an account you care about offers a passkey, it is worth considering, since there is no password for anyone to steal or trick you into giving away. Until that is available everywhere, a strong generated password remains the best default.

Practical Advice for Different Kinds of Users

Students

Student accounts tend to multiply quickly: a school portal, an exam registration site, an email address, learning platforms and social media. It is tempting to use one easy password for all of them, especially when sharing phones with friends or family. Use a generated password for your main email and school portal, and avoid logging in on borrowed devices. If you must use a cyber cafe or a friend’s computer, log out completely afterwards and never let the browser save the password.

Writers and Online Publishers

If you publish stories, novels or blog posts online, your accounts are your livelihood. A hijacked author account can lose you readers, earnings and unpublished drafts. Give your publishing platform, your email and your cloud storage separate generated passwords, and keep a backup of your manuscripts somewhere that does not depend on the same login. Many writers also use a dedicated email address for their publishing work, which makes it harder for an attacker to find the account in the first place.

Job Seekers

A job application account holds your full name, phone number, address, qualifications and often a copy of your identity documents. Recruitment portals vary widely in quality, so assume that any one of them could be breached one day. A unique password for each portal means that a leak on one does not expose your others. Keep your main email especially well protected, since employers contact you there and a hijacked inbox could be used to impersonate you.

Small Business Owners

Business accounts, such as online shops, payment processors, accounting tools and social media pages used for selling, deserve more care than personal ones. Use a separate generated password for each tool, turn on two-step verification, and avoid sharing one login among several staff. If someone leaves the business, change the passwords they could access straight away. Sharing passwords in a large WhatsApp group is convenient but risky, because anyone who gets hold of one member’s phone gets access to the conversation history.

What to Do If You Think a Password Has Been Exposed

If an account behaves strangely, for example login alerts you did not trigger, messages you did not send, or a password that suddenly stops working, act promptly. Use the official recovery option to reset the password from a device you trust, and generate a fresh password rather than tweaking the old one. Then check your recovery email and phone number to make sure they have not been changed, and look at the list of devices or sessions logged into the account and sign out any you do not recognise.

If you used the same password anywhere else, change it there too, starting with your email. If the account is connected to money, such as a bank, wallet or payment app, contact the provider directly through its official channels. Finally, run a basic check on your own device. If your phone or computer has malware, a new password can be stolen again as soon as you type it, so make sure the device itself is clean and updated.

A Simple Routine That Actually Lasts

The best password habit is one you can keep up without effort. Generate a unique password whenever you create an account, paste it directly into the form, and save it in your manager or other safe place at once. Turn on two-step verification for the accounts that matter most. Keep your recovery details up to date. Do not respond to messages asking for codes or passwords. Handle those few things consistently, and you will be far safer than most people who rely on memory, however clever their passwords look.

Frequently Asked Questions About Password Generators

How do I create a strong password?

The most reliable way is to let a generator create it for you. A strong password is long, random and unique to one account. Set the length to at least 12 characters, and go to 16 or more for email, banking and anything that can reset other accounts. Include the character types the website accepts, copy the result, paste it into the form, and save it right away. Avoid building the password from your name, phone number, birthday or favourite club, because those are the first things attackers try.

How long should a password be?

For ordinary accounts, 12 to 15 random characters is a sensible baseline. For your email, banking, cloud storage and password manager, use 16 or more. Length matters more than clever symbols, because every extra character multiplies the number of combinations someone would have to try. If a website limits the maximum length, use the longest password it allows. A short password stays weak even when it contains capitals, numbers and symbols.

Is it safe to use an online password generator?

It can be, provided the tool creates the password inside your browser and does not send it anywhere. The generator on this page states that the password is created locally and is not sent to this website. Even so, safety also depends on your device. Use the tool on a phone or computer you trust, avoid public or shared devices, and do not let anyone watch your screen. Once generated, store the password somewhere secure, and never post it in a public chat.

Does the password generator store or send my password?

According to the description of this tool, the password is generated locally in your browser and is not sent to the website. That means the site does not need to see or keep what you create. Because of that, the site cannot recover a password for you later. If you close the page without saving it, the password is gone, and you would need to generate a new one and update the account.

Are generated passwords really random?

A good generator uses your browser’s built-in random number features to pick characters without any pattern, which is very different from how humans choose. When you invent a password, you lean on familiar words, dates and habits, so it looks complicated but follows a predictable shape. A generated password has no such shape. If you are unsure about a particular tool, look for a clear statement that it generates passwords locally, and avoid tools that ask for personal details first.

How can I remember a random password?

You generally should not try. A random password of 16 characters is not meant to live in your memory, and the better approach is to store it in a password manager or your device’s built-in password saving, so it fills in automatically. The only passwords worth memorising are the few that unlock everything else, such as your phone lock, your computer login and your password manager’s master password. For those, a passphrase made of several unrelated words is easier to remember.

Can I use a password generator on an Android phone?

Yes, the tool works in a normal mobile browser such as Chrome. Open the page, generate a password, press and hold the text to select it, choose Copy, and paste it into the app or website where you are signing up. Android can also offer to save the password to your Google account, so it fills in later. Make sure your phone has a screen lock, and avoid taking screenshots of the password, since screenshots often back up to cloud storage automatically.

Can I use it on an iPhone or iPad?

Yes, it works in Safari and other mobile browsers on iPhone and iPad. Generate the password, press and hold to select it, tap Copy, and paste it into the account form. Apple devices can save passwords to iCloud Keychain so they fill in automatically on your other Apple devices. As on any phone, set a strong screen lock and protect your Apple account with a unique password and two-step verification.

Do I need to install anything to use it?

No, the generator runs in your web browser, so there is nothing to download. That is helpful on phones with limited storage and on computers where you cannot install software, such as a school or office machine. A modern browser and an internet connection to load the page are all you need. For long-term storage of your passwords, you may want a separate password manager, but that is optional and independent of this tool.

Should my password include symbols?

Symbols help, but length helps more. Adding symbols increases the pool of characters, which makes guessing harder for the same length. However, some websites reject certain symbols, and symbols can be awkward to type on a phone. If a site refuses your password, turn symbols off and increase the length instead. A long password made only of letters and numbers can still be stronger than a short one filled with symbols.

Why does a website reject my generated password?

Usually because the site has its own rules about length, allowed characters or required character types. Some limit the maximum number of characters, some refuse specific symbols, and others insist on at least one capital letter or number. Read the rules shown on the form, then adjust the generator settings to match. Do not edit the password by hand to fit, because manual changes can create patterns. Generate a fresh one that follows the rules instead.

What is the difference between a password and a passphrase?

A password is usually a string of random characters, while a passphrase is a series of words, such as four or five unrelated ones joined together. Passphrases are easier to remember and can be strong when the words are chosen randomly. They should not be a quote, song lyric, proverb or verse, because attackers try those. Use a passphrase for what you must memorise, like your phone or password manager, and a random generated password for everything else.

Is it okay to use the same password for different accounts?

No, because one leak can expose all of those accounts. If a website is breached, attackers take the leaked email and password and try them on other popular services. This works whenever people reuse passwords, however strong the password is. Using a different generated password for each account keeps a breach contained to one site. If you have reused passwords for years, start by changing your email password, then banking, then social media.

How often should I change my passwords?

There is no single schedule that suits everyone. Many security guidelines now recommend changing a password when there is a reason, such as a suspected breach, a lost device, a login you do not recognise, or a service announcing a leak. Constant forced changes often lead people to choose weaker, predictable passwords. A unique, random password protected by two-step verification is usually better than a weak one changed every month. If you are unsure about an account, change it.

Where should I save the passwords I generate?

A password manager is the best option, because it stores passwords in an encrypted vault and fills them in for you. Your phone or browser’s built-in password saving is also a solid choice if your Google or Apple account is well protected. A paper notebook kept at home can work for people who are not comfortable with apps. Avoid screenshots, unlocked notes, plain text files and sending passwords to yourself on WhatsApp or SMS.

Is a password manager safe to use?

A reputable password manager is generally a much safer choice than reusing passwords or relying on memory. It encrypts your saved passwords and protects them with a master password. The important part is to make that master password long and unique, and to turn on two-step verification for the manager itself. No tool removes all risk, but using a manager makes it realistic to have a different strong password on every account.

What makes a password weak?

A password is weak when it is short, predictable or tied to your personal life. Common examples include names, birthdays, phone numbers, football clubs, dictionary words, keyboard patterns like “qwerty” and simple sequences such as “123456”. Adding a number or symbol at the end does not fix this much, because attackers try those habits early. Reusing the same password across sites also makes it weak in practice, since a leak anywhere puts every account at risk.

Can I use my name or birthday in a password?

You should avoid it, even when you add numbers or symbols. Names, dates of birth and phone numbers are easy to find or guess, and attackers’ tools are built to try them in common combinations. A version like “Name@2024” feels secure but follows a very familiar pattern. A random generated password has no connection to you, which is exactly why it holds up better. Save personal details for security questions only if you have to, and answer carefully.

Do I still need two-step verification if my password is strong?

Yes, because a strong password and two-step verification protect against different problems. A password can still be stolen through phishing, malware or a fake login page. With two-step verification turned on, an attacker also needs the second code or approval. Turn it on for your email, banking apps, social media and any account holding money or documents. An authenticator app is generally safer than text messages, and you should never read a verification code out to anyone who asks.

How do I make a strong Wi-Fi password?

Generate a long random password and set it in your router’s settings. Wi-Fi passwords are typed on several devices, so choose a length that is long but still manageable, and consider turning symbols off to avoid typing mistakes. Replace the default password that came with the router, and keep the new one written on a card at home, not shared in public groups. If someone you no longer trust knew the old password, change it.

What should I do if I forgot to save a generated password?

If you have not finished creating the account, generate a new password and save it properly before continuing. If you already used it, go to the website’s “Forgot password” option and reset it, then store the new password right away. The generator cannot retrieve a password you made earlier, because it is created in your browser and not kept. Next time, save it before you submit the form, so you are never locked out.

How do I know if my password has been leaked?

Warning signs include login alerts you did not trigger, messages you did not send, password reset emails you did not request, or a password that suddenly stops working. Some password managers and browsers can also warn you when a saved password appears in a known breach. If you see any of these signs, reset the password from a trusted device, change it anywhere else you used it, and review your recovery email, phone number and active sessions.

Is it safe to share a password on WhatsApp?

It is risky, especially in large groups. Messages stay on every member’s phone and in backups, so anyone who gains access to one phone can read the history. If you must share a password, such as for a team account, send it privately to the one person who needs it, and change it when they leave. A better approach is giving each person their own login, so access can be removed without changing everyone’s password.

What is a passkey, and is it better than a password?

A passkey lets you sign in with your fingerprint, face or device screen lock instead of typing a password. Because there is no password to type, there is nothing for you to be tricked into entering on a fake site. Passkeys are supported by a growing number of services, but not everywhere yet. If an important account offers one, it is worth considering. Until passkeys are available on all your accounts, a strong, unique generated password remains the best default.

One Last Thing Before You Generate

Most account break-ins do not come from clever hacking. They come from reused passwords, guessable choices, fake login pages and codes handed to the wrong person. You can close most of those gaps in about ten minutes. Generate a new password for your email first, paste it in, save it somewhere safe, and turn on two-step verification while you are there. Then work through your banking and social media accounts at your own pace, one at a time.

You do not need to be technical to do this well. The generator above does the hard part of choosing, and your job is simply to use it, save the result, and keep it to yourself.