Generate strong passwords

How passwords are generated

Random choices come from the browser's cryptographic crypto.getRandomValues API rather than Math.random. At least one character from every selected set is included before the result is shuffled.

Generation happens on the device. NoFussKit does not transmit, store or recover generated passwords, so save the result in a trusted password manager if you use it.

Length and character sets

Length can range up to 128 characters. Uppercase, lowercase, numbers and symbols increase the possible combinations. The similar-character option removes O, 0, I, l and 1 from applicable sets.

For important accounts, 16 to 20 random characters with several sets is a practical starting point. A longer password is generally more valuable than complicated predictable substitutions.

• Cryptographic browser randomness
• Up to 128 characters
• Optional similar-character exclusion
• At least one character per selected set

Understanding the strength label

The displayed score checks length and the presence of lowercase, uppercase, numbers and symbols. It is a quick local indicator, not a breach check or a guarantee against every attack.

Never reuse a generated password across services. Unique credentials prevent one compromised site from exposing other accounts.

Use with a password manager and MFA

Store unique passwords in a reputable password manager instead of a document, screenshot or chat. Confirm that the destination accepts the selected symbols before saving.

Enable multi-factor authentication when available. A strong password and MFA protect against different risks and work best together.