Uniqueness comes first
Password reuse turns one breached service into a risk for every other account using the same value. Generate a different password for each account and store the association in a reputable password manager. Changing one character or appending a site name produces related passwords that can be easier to predict.
Prefer length and randomness
Longer secrets create a larger guessing space when every character or word is selected randomly. A 16-character random password is a useful default when a service accepts it; more length can be appropriate for especially important credentials or less varied character sets. Always respect the service’s limits.
Use passphrases for secrets you must type
A generated passphrase selects words randomly. Its strength comes from the number of possible words and the number selected—not from clever substitutions in a familiar sentence. Adding more randomly selected words increases the choice space while preserving readability.
Understand the entropy display
Entropy is a mathematical estimate of uncertainty under the stated generation method. It is not a security grade for an account. Malware, screenshots, shoulder surfing, clipboard managers, phishing, insecure reset flows and server breaches can bypass a strong password.
PINs, UUIDs and API-style keys
A PIN may be constrained by the receiving system and often has online attempt limits; use the longest random PIN accepted. A UUID is designed as an identifier and should not automatically be treated as a secret. API systems frequently require a specific prefix, length or encoding, so follow their documentation and use their native key-creation flow when required.
What this tool does not do
Ready Passwords does not inspect current passwords, detect known breaches, store a vault, synchronize devices or recover generated values. Local generation reduces one category of data transfer, but cannot establish that the device itself is trustworthy.
Checklist
- Use a unique secret for every account.
- Prefer at least 16 random characters when supported.
- Store passwords in a reputable password manager.
- Enable strong multi-factor authentication.
- Never send passwords through ordinary email or chat.
- Rotate credentials promptly when compromise is suspected.
Primary reference
For current identity and password guidance, consult NIST Special Publication 800-63B. Its guidance also explains why length, compromised-password screening and password-manager support matter.
Published and last updated 6 September 2026. This is general security education, not a guarantee against compromise.