Skip to content
Kaagazo.
FreeADMIN UTILITY

Password Generator

Create secure, random, high-entropy cryptographic passcodes for server and admin accounts.

100% client-side. Nothing you type is uploaded or stored on a server.

The GST portal, the bank, the marketplace seller account, the email that resets all of them, the WhatsApp Business API, the router — a small business runs on twenty passwords, and the one that is "Shop@2024" everywhere is the one that gets phished. This generator creates strong, random passwords and passphrases in your browser using the cryptographic random source of your device: choose length, character sets, or a memorable multi-word passphrase, and copy it into your password manager. Nothing is generated on a server; nothing is stored.

What makes a password strong

Strength is about length and randomness, not clever substitutions. "P@ssw0rd!" is cracked in minutes by dictionary rules; "vault-cobra-monsoon-ledger-72" is not. Guidelines:

  • 16+ characters for anything that matters; 12 is the floor for low-risk accounts.
  • Random, from a generator — not a name, a date or a pattern.
  • Unique per site: a breach at one service must not open the others.
  • Passphrases of four to six random words are as strong as complex strings and far easier to type on a phone.
  • Add two-factor authentication wherever offered — the GST portal, bank, Google, Meta and marketplaces all support it.

Check any existing password's resistance to brute force with the password strength checker.

How to use the generator

  1. Choose random string or passphrase.
  2. For strings, set the length (16–24 recommended) and which sets to include — upper, lower, digits, symbols; exclude look-alike characters (O/0, l/1) if it will be typed by hand.
  3. For passphrases, choose the number of words (4–6), the separator and whether to add a number.
  4. Copy the result; it is cleared from the screen when you leave the page.
  5. Store it in a password manager (the browser's built-in one is fine for a start) — never in a WhatsApp note.

Where small businesses get breached

  • GST and income-tax portal OTP fraud: callers pretending to be officers ask for the OTP "to verify". No portal ever asks; see GST scam calls, fake notices and OTP fraud.
  • Shared passwords with ex-staff still working — rotate when someone leaves, along with the WiFi password.
  • Reused email passwords: the email that resets everything needs the strongest password and 2FA.
  • Website admin logins on WordPress with default usernames — the hardening checklist is in WordPress 7.1.1 security update.
  • Router defaults (admin/admin) on the shop's broadband.

Policy for a small team

  • One password manager for the business, shared vaults per role.
  • Unique 16+ character passwords for every service; passphrases for anything typed on a phone.
  • 2FA mandatory on email, bank, GST, marketplaces and social accounts.
  • Rotate shared credentials on staff exit — add it to the experience letter checklist.
  • Never send passwords or OTPs over WhatsApp or SMS.

Frequently asked questions

Is the password generated on your server?

No. It is generated in your browser using the device's cryptographic random number generator and never transmitted.

How long should a password be?

At least 16 characters for important accounts; passphrases of 4–6 random words are equally strong and easier to remember.

Are passphrases really secure?

Yes — five random words from a large list have more entropy than a 12-character complex string, and are far less likely to be written on a sticky note.

Should I change passwords regularly?

Only when there is reason — a breach, a departing employee, a shared device. Forced rotation without cause leads to weaker, patterned passwords.

What if the site limits password length?

Use the maximum it allows with all character sets, and turn on 2FA for that account; report the limit to the provider.