Secure Password Generator

Why you need a secure password generator

In 2026, 80% of personal account hacks are due to weak or reused passwords. If you use the same password on multiple sites and one of them suffers a leak (which happens weekly), attackers automatically try that combination on hundreds of popular services. A strong, unique password for each account is today the basic measure of personal cybersecurity. The Zortyx password generator creates robust keys in one click, adapted to the security level you need, using real cryptographic randomness.

How to use the generator step by step

1. Choose the length: minimum recommended is 12 characters. For critical accounts (email, banking, password manager) use 16 or more.
2. Select character types: uppercase, lowercase, numbers and symbols. Check all the destination system allows for maximum security.
3. Click Generate: you'll get a completely random password instantly.
4. Copy to clipboard: one click. Paste it in the registration or password change form of the site where you'll use it.
5. Save it in a password manager: never try to memorize it. Use Bitwarden, 1Password, KeePass or your browser's built-in manager.

What makes a password strong?

Password strength depends on two factors: length and character diversity. An 8-character password with only letters has about 208 billion combinations — sounds like a lot, but a modern computer can try them all in under an hour. A 16-character password with uppercase, lowercase, numbers and symbols has 94¹⁶ combinations, equivalent to billions of years even with specialized hardware.

Estimated time to crack a password by brute force

• 8 characters, letters only: a few minutes
• 8 characters, letters + numbers: several hours
• 12 characters, letters + numbers + symbols: 3,000 years
• 16 characters, all types: 34 billion years
• 20 characters, all types: practically impossible with current technology

These calculations assume an attacker capable of trying one billion combinations per second (specialized GPU hardware). The conclusion is simple: each additional character exponentially multiplies the attack time.

Use cases: where you need strong passwords

Critical accounts (top priority)

Main email, bank, password manager, crypto accounts and work admin accounts. For these always use 16+ characters with all symbol types, and enable two-factor authentication (2FA).

Social media and personal services

Instagram, Twitter, Facebook, TikTok, Netflix, Spotify. 14-16 characters with full diversity. Although they seem less important, a hacker in your Instagram can phish your friends pretending to be you.

Work accounts and professional tools

Slack, Notion, Google Workspace, GitHub, AWS. Many companies suffer cyberattacks due to weak employee passwords. Always use unique long passwords (16+) and enable 2FA.

Secondary services

Forums, occasional online stores, newsletters. 12 characters can be enough here, but keep the rule of one unique password per site. Reusing is the most common and dangerous mistake.

Home Wi-Fi

Your router password should be long (20+ characters) but easy to read and type for guests. One option is to generate a sequence of 4 random words with symbols between them.

Advantages of the Zortyx generator

• Cryptographically secure: uses crypto.getRandomValues(), not Math.random(). Your passwords are truly unpredictable.
• Local generation: the password never leaves your browser. No server sees or stores it.
• Full customization: choose length and character types according to each site's requirements.
• No persistent history: generated passwords are not saved in cookies or any browser storage.
• Free without limits: generate all the passwords you need, whenever you want, no signup.

Good security practices

1. One password per account. Never reuse. If a site leaks and you don't reuse, damage is limited to that account. If you reuse, attackers will try that combination on every service.

2. Use a password manager. Bitwarden is free, open source, works on all devices and frees you from memorizing dozens of passwords. You only memorize one master password (which should be very strong and memorable).

3. Enable 2FA wherever you can. Even if your password leaks, the attacker would also need your one-time code. Use apps like Authy or Aegis, not SMS (SMS can be intercepted via SIM-swapping).

4. Check leaks regularly. Visit haveibeenpwned.com with your email to see if your credentials appear in any known public leak. Change any compromised password.

5. Distrust old advice. Changing passwords every 3 months without reason is counterproductive (forces users to create weak variations). Current advice is: strong password + manager + 2FA, and only change if compromise is detected.

Frequently asked questions

Is it safe to generate passwords on a website?

Depends on the website. On Zortyx yes, because generation is 100% local in your browser (client-side JavaScript) and is not sent to any server. You can verify with browser developer tools: no network requests when generating. But beware of sites that generate passwords on the server: those could log them.

Can I generate passphrases?

Currently the generator produces classic passwords (random character sequence). Passphrases (4-6 random joined words) are another valid option, easier to memorize but require more length. We will add passphrase generation in future versions.

What length should I pick if unsure?

By default, 16 characters with all types is an excellent universal choice: strong enough for any account, not excessively long to paste comfortably. If the site allows, use 20.

Why do strange symbols appear that I can't type?

The generator uses the standard ASCII printable symbol set. If your keyboard has trouble with any symbol, disable the symbols option and compensate with more length. Most password managers autofill anyway so the problem rarely appears.