How to Generate a Password: Modes, Limits and Safe Workflows

Use a password manager to generate and save a different password for each account. If you need a browser generator, choose a mode that fits the account's rules, inspect the result and save it before leaving the page. A readable string is not automatically a strong master passphrase.

Reviewed October 10, 2026 against the current TextToolbox controls and the sources below. Every example in this guide is public demonstration text. Never use an example as your password.

A generator is not a password manager

A generator creates a string. A manager stores credentials and helps you use them. An account's recovery process, multi-factor authentication and device security still matter.

• Create an account password: use your manager's password generator, or TextToolbox's Random mode. Check the accepted length and character groups, and save a unique result.
• Create a manager's master passphrase: follow the manager's guidance and use an appropriate large-list random-word method. Check the word-list size, the selection method and the recovery requirements.
• Explore readable patterns: TextToolbox's Pronounceable or Memorable mode. These use small lists and constrained patterns, with no high-entropy guarantee.
• Create mock identifiers: use the Random String Generator, and watch the source length, added separators and possible duplicates.

The TextToolbox Password Generator's Memorable mode uses 30 words. The Pronounceable tool's Word modes use 40. Those lists are much smaller than a purpose-built large-list passphrase method. Do not choose them for a master password on the strength of the word count or readable appearance.

Worked example: configure an account password

Suppose a test account accepts 20 characters, requires uppercase, lowercase and digits, and rejects symbols. These are example field requirements, not a rule for every website.

1. Open the Password Generator.
2. Select Random mode and length 20.
3. Enable uppercase, lowercase and numbers. Disable symbols.
4. Enable the option requiring each selected character type.
5. Click New Password, inspect the result and copy it into the intended field. Save it in your manager before closing the page.

For illustration, b7Qm2rK9vT4nX8cP3sL6 is 20 characters long, includes the three enabled groups and has no symbols. A new generation makes a fresh random selection; repetition is possible, and this example does not predict its characters. This public sample is only a check of the stated rules.

If the account rejects the result, read its exact requirement and change the matching control. Do not silently shorten a password or add a predictable personal suffix. Generate a fresh result with the right settings.

Why a crack-time table cannot grade these examples

The way a password was selected matters. A published sample, a personally chosen phrase and a uniformly generated string can look similar while having different predictability. Online rate limits and offline password hashing also affect attacks.

NIST's password-strength discussion distinguishes predictable generation distributions from difficult-to-estimate human choices. It also explains that length does not prevent phishing or keystroke logging. That is why this guide does not assign fixed entropy or GPU cracking times to visible example strings. Read NIST's password-strength appendix.

The Random String Generator displays a rounded Shannon estimate for its current settings. It accounts for filtered source probabilities and case conversion. It is not a rating of an old result, a crack-time prediction or a certificate for a production token system. Grouping separators add length without adding randomness.

Whole words, exact length and exclusions

Pronounceable's Numbers option adds two digits. Symbols adds a separate final symbol. Selecting both preserves both digits. Avoid Adjacent Repeats concerns neighboring equal characters, not every recurrence of a character anywhere in the string.

In Random String, Exclude Similar blocks 0, O, l, 1 and I, including results of case conversion. For example, an uppercase conversion must not turn a permitted lowercase o into an excluded O. Title Case changes only the first source character, not the start of each formatted group.

Copy, history and recovery

Password and Pronounceable keep a limited history in component memory: up to eight and six results respectively, including the current generation. They do not write persistent history. Clear History removes previous results while leaving the current result visible. Reloading removes the component state; your device clipboard is separate.

If Copy fails, the tool shows a message. Select the displayed text and copy manually, then confirm the intended field received the complete string. Changing settings clears old Copy feedback; click Generate again to apply those settings. Random String's Copy All places one formatted result per line.

Keep account protection separate from formatting

Use different passwords across services and enable multi-factor authentication where available. NIST supports password-manager use and rejects routine forced password changes without evidence of compromise. These are verifier guidelines, not a promise that every service follows them. See NIST's password requirements.

For a master passphrase, follow your manager's documented method rather than treating any readable tool output as suitable. EFF's random-word method explains selecting words from its purpose-built list. Recovery behavior depends on the manager and account setup; keep the documented recovery materials safely.

TextToolbox uses browser Web Crypto for character selection. That random source does not make a generator a complete authentication system. MDN documents Web Crypto randomness and points developers to a dedicated API for cryptographic key generation.