Generate a Strong Password You Will Not Reuse — Then Put It in a Manager

The weakest password I still see in circulation is a favourite word, a birth year, and maybe an exclamation mark — then the same string on email, banking and a freelance marketplace. When one site leaks, the rest are open.

A generator does not make you secure by itself. It gives you a long, random string you can afford to forget, because a password manager remembers it. That is the habit worth practising.

What “strong” means on this page

The Password Generator on ToolSphare builds random passwords in your browser. The page states that it uses cryptographic randomness locally, that you do not need an account, and that there is no limit on how many you can create.

You can see the controls clearly:

• Length, default 16, adjustable from 4 to 128 with a slider or a number box
• Character sets: uppercase A–Z, lowercase a–z, numbers 0–9, symbols
• Exclude similar characters: i, l, 1, L, o, 0, O
• Number of passwords at once: 1, 3, 5 or 10
• Advanced: exclude characters, include space, avoid ambiguous punctuation

After you click Generate Password, you get the string, Copy and New buttons, a strength reading, and a checklist (at least 12 characters, mixed case, numbers, symbols, “strong password”). A password history panel stores earlier results only on this device, with a Clear all button.

The tips on the page are the ones that matter: use at least 12–16 characters, mix letters, numbers and symbols, avoid personal information, use a unique password per site, and store secrets in a password manager.

How to use it

1. Open the Password Generator workspace.
2. Set the length. Sixteen is a solid default; use more for email, banking or the manager’s master-adjacent accounts if a site allows it.
3. Leave letters, numbers and symbols on unless a site forbids symbols — some older portals still do.
4. Turn on Exclude similar if you will ever have to type the password from a printed note or a phone screen. Turn on Avoid ambiguous punctuation if the site has a picky character list.
5. If a site rejects $ or !, put those characters in Exclude characters and generate again, rather than editing the password by hand and accidentally making it weaker.
6. Click Generate Password, copy it straight into a password manager, then into the site. Do not paste it into a chat or an email to yourself.

A practical example: a freelance marketplace and a bank login

You are opening an Upwork or Fiverr account and a new internet-banking login. Both deserve unique passwords. Neither should be a variation of your email password.

For the marketplace, generate a 16-character password with all four character sets and similar characters excluded, so you can retype it if you ever have to. Save it in the manager under that site’s name. For the bank, generate a different 20-character password. If the bank’s form rejects spaces and a couple of symbols, exclude those and generate a fresh string — do not delete characters from the first one until it “looks easier”.

If you need a few options to see which a form will accept, set Number of passwords to 5, generate once, and pick one. Clear the on-page history when you are done, especially on a shared computer. History is local, but it is still on that device until you clear it.

A generator is a poor place to store the only copy of a password. If you close the tab without saving the string in a manager, it is gone. That is by design.

What not to do

• Do not reuse the same generated password on a second site because it was “already strong”.
• Do not add your name or a year on the end to “make it memorable”.
• Do not email passwords to colleagues. Share them through the manager’s sharing feature, or not at all.
• Do not generate a 4-character password just because the slider allows 4. The checklist flags 12 as a minimum for a reason.

FAQ

Is the password sent to a server?
The page describes generation as using cryptographic randomness locally, in your browser. History, when enabled, stays on the device. You should still avoid generating passwords on a public computer you do not control.

Why exclude similar characters?
Because l, 1, I, 0 and O are easy to mix up when you type from a screen or a notebook. Excluding them does not make a 16-character password weak; it makes it less annoying to type.

Can I generate more than one at a time?
Yes. The Number of passwords control offers 1, 3, 5 or 10 in one go.

Disclosure: I build ToolSphare, the free tools site that hosts the generator described above.