Password Generator
Articles, guides, and in-depth tips for the Password Generator — everything you need to get the most out of it.
✦ AI-powered — understands natural language
Why Composition Rules Make Passwords Weaker, Not Stronger
SMS and TOTP Can Both Be Phished in Real Time — Here's Which MFA Methods Are Actually Phishing-Resistant
SMS OTP and TOTP are both vulnerable to real-time phishing (AiTM attacks relay codes before they expire) — hardware keys and passkeys are phishing-resistant because their response is cryptographically bound to the exact URL. Here's the MFA security spectrum from SMS to passkeys, the MFA fatigue (push bombing) attack that compromised Uber in 2022, why number matching prevents rubber-stamping push notifications, and why security questions aren't a genuine second factor.
Why a Password Generator Using Math.random() Is Less Secure Than Its Length Suggests — Entropy, CSPRNG, and What to Check
A password generator using Math.random() is not cryptographically secure — a password's effective entropy is limited by the randomness quality of the generator, not just its length and character set. Here's what password entropy actually measures (bits of theoretical guessing difficulty), why crypto.getRandomValues() is categorically different from Math.random(), why length increases entropy faster than adding special characters, and how Diceware achieves verifiable physical randomness.
Why a Strong Password Isn't Enough: Credential Stuffing and the Case for Unique Passwords Everywhere
A password can be long, random, and never appear in any breach — and still get your account compromised, because the attack that actually breaks most accounts isn't guessing your password, it's trying a password that worked on a completely different site you used years ago. Here's how credential stuffing works, why password "strength" is irrelevant to this specific attack, and why a generator-plus-manager combination — making unique-per-site passwords practically achievable — directly closes this vector.
Passkeys: How FIDO2/WebAuthn Works and Why It's Replacing Passwords
Passkeys store a private key on your device and register only the public key with the website — there's nothing to phish, breach, or reuse. Here's how FIDO2/WebAuthn registration and authentication work, the difference between platform passkeys (iCloud, Google) and hardware keys, and the current state of passkey adoption.
Password Managers: How Zero-Knowledge Encryption Works and Which One to Choose
Credential stuffing is the main threat, and unique passwords are the defence — but only a password manager makes that practical at scale. Here's how zero-knowledge encryption works, Bitwarden vs 1Password vs KeePass compared, and how to set up recovery.
Why "P@ssw0rd1" Still Gets Cracked: What Password Strength Actually Means
Most passwords that "pass" complexity rules are still cracked in minutes. Here's how attackers actually work, what password entropy means, and why random generation beats human-chosen passwords every time.
Password Generator — Create Strong, Random Passwords Instantly
Learn what makes a password truly strong, why human-invented passwords fail, and how to use a free password generator to create cryptographically random credentials for every account.
