Password Generator

What makes a password generator secure?

The key is where the randomness comes from. Stax Password Generator uses crypto.getRandomValues() — defined in the W3C Web Cryptography API specification as the browser's cryptographically secure pseudorandom number generator (CSPRNG). This is the same source of entropy used to generate TLS session keys. It is not predictable, not seeded from the time of day, and not replayable.

The generated password never leaves your device. There is no API call, no clipboard sniffing, no analytics on the actual password value.

How to choose the right settings

NIST's SP 800-63B Digital Identity Guidelines recommend prioritizing length over forced complexity rules and allowing (rather than requiring) the full range of characters.

General accounts: 16 characters, all character sets enabled.
PINs or numeric codes: numbers only, 6–8 digits.
Passphrases (for memorization): use a passphrase generator instead — four random words are both stronger and easier to remember.
Legacy systems that cap at 8 characters: use all character sets at the maximum allowed length.

Password entropy explained

Entropy measures how unpredictable a password is, in bits. Each bit doubles the number of possible combinations. An 8-character password using only lowercase letters has ~37 bits of entropy — a modern GPU can crack that in under a second. A 16-character password from a 95-character pool (all ASCII printable) has ~105 bits — practically uncrackable with today's hardware.

Password manager recommendations

The safest approach is to use a different strong password for every account and store them all in a password manager. Leading options include Bitwarden (open-source, free tier is excellent), 1Password (best UX, paid), and KeePassXC (fully offline, self-hosted). Avoid browser-saved passwords for critical accounts — they sync across devices but are accessible to anyone with physical access to your unlocked device.

Enable two-factor authentication (2FA) on your password manager and on all important accounts. Even if a password is leaked in a data breach, 2FA prevents an attacker from logging in without your second factor. Use an authenticator app (Google Authenticator, Authy) rather than SMS-based 2FA, which is vulnerable to SIM-swap attacks.

Frequently asked questions

Is it safe to generate passwords online?

Yes, when it's done entirely client-side. Stax Password Generator uses the Web Crypto API (crypto.getRandomValues) — the same cryptographically secure random number generator used by browsers for TLS. Your password is never sent to a server, never logged, and never stored.

How long should my password be?

At least 12 characters for most accounts; 16+ for email, banking, and anything you really care about. Length matters more than complexity — a 20-character lowercase-only password is far harder to brute-force than an 8-character one with symbols.

What makes a password strong?

Length (16+ characters), randomness (not based on words or patterns), and uniqueness (different password for every account). Enable uppercase, lowercase, numbers, and symbols for maximum entropy.

Should I include symbols?

Yes, if the site allows it. Symbols dramatically increase the number of possible combinations. Some services restrict which symbols they accept — if a generated password is rejected, just regenerate without symbols.

Where should I store generated passwords?

In a password manager: 1Password, Bitwarden, Dashlane, or your browser's built-in manager. Never in a plain text file or spreadsheet. A good password manager remembers all your unique passwords so you only need to remember one master password.