Length is the main lever
A 20-character random password from a large alphabet has far more entropy than an 8-character string that satisfies "one upper, one number, one symbol" rules. Prefer length and true randomness over human-memorable complexity theater.
Generation and storage
Separate the concerns:
- Generate with a CSPRNG (browser crypto.getRandomValues is fine)
- Store user passwords with a slow hash (bcrypt, argon2) — never plaintext or reversible encoding
- Use a password manager for secrets humans must type
- Prefer passkeys / WebAuthn where the product allows
Generate and hash on code.live
Use the Password Generator for strong random strings, and the bcrypt tool when you need a quick hash for local testing. Never paste real production credentials into any online tool.