Check the conditions and generate a random password
Set the character count, character types, ambiguous characters, and additional excluded characters, then generate multiple candidates in the browser.
Create a password with a specified character countConclusion: Choose a sufficiently long random value within the policy, not one single correct character count
NIST SP 800-63B-4 indicates a verifier policy allowing at least 15 characters for a single factor, at least 8 characters when part of MFA, and a maximum length of at least 64 characters.
Lengths alone, such as 8, 12, or 16, cannot evaluate generation rules, reuse, disclosure, or storage. Even at the same length, a human-created predictable value and a uniformly random value are different.
Determine the number of characters users must enter by checking the target Service's Policy and authentication method.
How to distinguish 8-, 12-, and 16-character values
Eight characters match the minimum NIST indicates as part of MFA, but are not a requirement for single-factor use. Twelve characters also do not reach the 15-character baseline, while 16 characters exceed it; however, none of these prevents reuse or disclosure.
DevelopTools can generate values from 4 to 128 characters. It can create short values for service compatibility, but they are not recommended values that guarantee security.
| Item | How to check | judgment |
|---|---|---|
| 8 characters | MFA or single factor | Do not misunderstand the purpose |
| 12 characters | Compatibility with existing Policy | Check randomness as well |
| 16 characters | Maximum length and prohibited symbols | Candidate if acceptable |
| More than 64 characters | Maximum Service length | Also check for truncation |
How to check using the secure password generator
- Check the destination's minimum and maximum length.
- Switch between 8, 12, 16, and 20 characters using the same character set, and check changes in theoretical Entropy.
- Generate long candidates within the range accepted by the destination.
- After registration, verify by logging in again that it was not truncated.
The default value of 20 characters is a general starting point, not a guaranteed value suitable for every service.
Items that cannot be judged by character count alone
- Whether it includes predictable words, dates, or keyboard patterns
- Whether the same value is used by another service
- Whether it matches a known leaked blocklist
- Check whether the Server truncates values without validating their full length.
- Whether another factor such as MFA or a passkey is also used
Evaluate length, character set, and operation separately
| Perspective | What to Check | What the generator can do |
|---|---|---|
| Length | The minimum and maximum length at the destination | Specify from 4–128 characters. |
| Character type | Allowed, prohibited, and required characters | Selection and additional exclusions for four character types |
| Randomness | Whether predictable rules are being used | Generate with Web Crypto API |
| Reuse | Whether the same secret is used by another service | Generate multiple candidates, but do not reuse the same candidate. |
| Storage | Is the storage destination safe for reuse? | Save it outside the tool, such as in a password manager |
| Leakage | Whether it matches known leaked values or blocklists | Not compared by the current tool |
NIST SP 800-63B-4 indicates a verifier policy allowing passwords of at least 15 characters for a single-factor authenticator, at least 8 characters when part of MFA, and a maximum length of at least 64 characters. This does not mean users should uniformly enter 15 characters for every web service. Prioritize checking the policy on the actual registration screen.
The same guidelines do not require verifiers to enforce composition rules that uniformly require mixed character types, or arbitrary periodic changes when there is no sign of compromise. Instead, they recommend rejecting common, predictable, and known-compromised values with a blocklist, and allowing password managers and paste.
DevelopTools password generation features and evaluation scope
| Item | Current tool specification |
|---|---|
| Length | 4–128 characters. The default is 20 characters. |
| Number to generate | 1–20 items. The default is 5 items. |
| Character set | Select lowercase letters, uppercase letters, numbers, and symbols separately |
| Additional conditions | Exclude ambiguous characters, add or exclude arbitrary characters, and include at least one character from each selected character type. |
| Randomness | Use crypto.getRandomValues() and rejection sampling |
| Sort | Fisher–Yates shuffle using cryptographically secure random values |
| Result | Individual copy, copy all, and a theoretical entropy estimate based on character set and length |
| Unsupported | Passphrase generation, leaked Password checks, arbitrary custom character sets, automatic Clipboard clearing, and generation history storage |
"Characters to use" is the allowed character set added to generation candidates. Only when "Include at least one from each character type" is enabled is each selected class treated as a required character class that must contribute at least one character.
The strength display is a theoretical value that assumes each character is selected independently and uniformly from the chosen character set. It does not assess leaked passwords, prohibited characters at the destination, maximum length, authentication methods, or storage state after entry.
Check browser-side generation and handling after copying
The current tool completes generation in the browser and does not send generated passwords to the DevelopTools server or external APIs. It also does not store generated values in URLs, LocalStorage, generation history, or analytics.
- Before generation, check the destination's character limit, allowed symbols, and required conditions
- Assign each generated value to only one service; do not reuse it for another service
- After copying, consider that it may remain in OS or browser clipboard history
- On shared PCs, also check handling of the screen, clipboard history, input assistance, and extensions
- If storage is necessary, move it to a trusted password manager or similar tool, and avoid plaintext memos and screenshots.
Browser processing reduces transmission paths, but it does not guarantee protection against device malware, malicious extensions, screen viewing, or clipboard monitoring. Assess security including the device used and storage destination.
Check current recommendations using primary sources
- NIST SP 800-63B-4：Password Authenticators
- NIST SP 800-63B-4：Strength of Passwords
- MDN：Crypto.getRandomValues()
- MDN：Math.random()
Read NIST numbers as requirements for authentication verifiers; do not confuse them with individual service registration policies or DevelopTools security certification. Prioritize MDN and the Web Cryptography specification for Web API usage and browser support.
Example: Generate 20 characters for a service with a 32-character maximum
If the registration screen accepts 8–32 characters, specify 20 characters and create candidates using only allowed character sets.
You can create a value that does not exceed the maximum length and is sufficiently longer than the minimum length. Separately check whether it may be rejected by service-side leak blocklists or prohibited symbols.
- Check 8–32 characters.
- Specify 20 characters
- Select allowed characters
- Generation and registration
- Reconfirm login
Increasing character count does not solve reuse of the same password.
Frequently asked questions
- How many characters make a password secure?
- You cannot determine this from character count alone. NIST SP 800-63B-4 requires Verifiers to accept single-factor Passwords of at least 15 characters, or at least 8 characters when part of MFA. Check destination limits and authentication methods, and generate sufficiently long random values for each Service.
- Is it safe if I include uppercase letters, numbers, and symbols?
- A larger character set increases the number of candidates, but that alone does not establish security. Consider sufficient length, cryptographically secure random values, no reuse, changes after compromise, and secure storage together.
- Can I use a Password generated with Math.random()?
- Not suitable for Security use. Since Math.random() is not a cryptographically secure random source, use a CSPRNG such as crypto.getRandomValues() in the Browser.
- Can I use the same strong Password for multiple Services?
- Not recommended. A leak from one account can be used for Credential Stuffing against other Services, so generate and manage a different Password for each Service.