Free Secure Password Generator
Weak passwords are the easiest attack vector. Dokall generates cryptographically random passwords with configurable length, uppercase, lowercase, numbers, and symbols.
Use it to create account passwords, API test credentials, or temporary access tokens. Generation runs entirely in your browser - passwords are never sent to any server.
What Makes a Password Strong?
A strong password is one that cannot be guessed or cracked in a practical amount of time. Strength depends on two factors: length and character diversity.
A 12-character password using only lowercase letters (26 possible characters per position) has 26^12 combinations - about 95 trillion. A 12-character password using lowercase, uppercase, digits, and symbols (roughly 95 characters per position) has 95^12 combinations - about 540 sextillion. The second password is over 5 billion times harder to crack.
However, length matters more than complexity. A 20-character lowercase password (26^20) is astronomically stronger than a 12-character password with all character types (95^12). This is why modern security guidance recommends long passphrases over short complex passwords.
Password Entropy Explained
Entropy measures the randomness of a password in bits. A password with n bits of entropy has 2^n possible combinations. More bits means harder to crack.
A random lowercase character adds about 4.7 bits of entropy (log2(26)). A random character from the full printable ASCII set adds about 6.6 bits (log2(95)). A 16-character random password from the full character set has about 105 bits of entropy - well beyond what brute-force attacks can crack with current technology.
The catch: this assumes the password is truly random. If a user picks a "random-looking" password like Tr0ub4dor&3, the actual entropy is much lower because it follows predictable substitution patterns (o to 0, a to 4) that password crackers know to try. Only cryptographically random generation provides the full theoretical entropy.
Passwords vs Passphrases
A passphrase like correct-horse-battery-staple uses random dictionary words separated by a delimiter. With a 7,776-word dictionary (standard Diceware list), four random words provide about 51 bits of entropy. Six words provide about 77 bits.
Passphrases are easier to type and remember than random character strings of equivalent strength. A 25-character passphrase of four words is more practical than a 12-character random string, even though the random string might have higher per-character entropy.
For passwords that are stored in a password manager and never typed manually, maximum-entropy random strings are ideal - you never need to remember them. For passwords you do type regularly (device login, master password), a long passphrase with 5-6 random words is a good balance of security and usability.
Common Password Mistakes
Reusing passwords across sites is the most damaging mistake. When one site is breached, attackers try the same credentials on banking, email, and social media accounts (credential stuffing). A password manager eliminates this risk by generating a unique password for every account.
Using personal information (birthdays, pet names, addresses) makes passwords vulnerable to targeted attacks. Social media profiles often contain exactly the information people use in passwords.
Predictable patterns - adding a digit at the end, substituting @ for a, capitalizing only the first letter - are well-known to password crackers. These substitutions add almost no security. If your base word is in a dictionary, the substituted version is likely in a cracking wordlist too.
Writing passwords on sticky notes, sharing them in chat messages, or sending them by email creates risk that no password strength can compensate for. Use a password manager to share credentials securely.
Storing Passwords Safely (for Developers)
Never store plaintext passwords. Use a slow, salted hashing algorithm designed for password storage: bcrypt, scrypt, or Argon2id. These algorithms are intentionally slow, making brute-force attacks impractical even if the hash database is stolen.
Fast hashes like SHA-256 and MD5 are wrong for passwords. A modern GPU can compute billions of SHA-256 hashes per second, cracking most passwords in hours. bcrypt with a cost factor of 12 limits an attacker to a few thousand attempts per second per GPU.
Always use a unique random salt per password. The salt is stored alongside the hash (bcrypt includes it automatically). Without salting, identical passwords produce identical hashes, allowing attackers to crack all instances at once using precomputed rainbow tables.
Set a minimum password length (NIST recommends 8 characters minimum, 12+ is better) and check against a list of breached passwords (the Have I Been Pwned API provides this). Avoid maximum length limits under 64 characters and avoid composition rules (must include symbol, uppercase, etc.) - they annoy users without meaningfully improving security.