"P@ssw0rd" is in every cracking dictionary. "correct-horse-battery-staple" is not. Length beats complexity, and randomness beats both. Below: how to generate passwords that hold up under attack, which free tools do it correctly, and one browser password manager risk most people miss.
Length Beats Complexity: The Entropy Explanation
Entropy measures how many guesses an attacker needs to crack a password. It scales with two variables: the pool of possible characters and the password length. Length wins because it is an exponent.
A password using only lowercase letters (26-character pool) at 16 characters has 26^16 = 43 quadrillion possible values. A password using every printable ASCII character (95-character pool) at 8 characters has 95^8 = 6.6 quadrillion possibilities. The longer lowercase password has 6x more entropy despite a smaller character pool.
This is why "correct-horse-battery-staple" — four random common words — beats "P@ssw0rd1!" in every meaningful way. The four-word passphrase has roughly 44 bits of entropy (assuming random word selection from a 7,776-word list). "P@ssw0rd1!" has been cracked so many times it appears in breach databases in its exact form. Pattern-substituted passwords (letters replaced with symbols) fail against dictionary attacks that include common substitutions.
The practical rule: minimum 16 characters for stored passwords. Use 20 for email and financial accounts. Passphrases are fine for passwords you need to type; random character strings for everything stored in a manager.
Bitwarden Generator: Specific Settings That Matter
Bitwarden is free, open-source, and the password manager with the strongest case for default recommendation. Its built-in generator runs locally inside the app — passwords are not generated server-side.
Settings for stored passwords: Open Bitwarden, go to Generator. Set Type to "Password". Set Length to 20 (16 minimum, 20 preferred for high-value accounts). Enable Uppercase, Lowercase, Numbers, and Special characters. Enable "Avoid ambiguous characters" — this removes O/0, I/l/1, and other visually similar pairs. You will not notice the difference in entropy, but you will notice when you have to type a password manually and cannot tell if it is a zero or letter O.
Settings for passwords you type regularly: Switch Type to "Passphrase". Set Words to 4. Enable "Capitalize". Set Separator to hyphen. The output, something like "Lantern-Gravel-Frozen-Maple", is strong, memorable enough for manual entry, and far harder to guess than anything human-chosen.
Bitwarden's vault is encrypted with AES-256 and only decrypted locally using your master password. Bitwarden employees cannot read your passwords. The source code is publicly available and has been independently audited by Cure53 (2018) and Insight Risk Consulting (2023).
KeePass: Maximum Control, No Cloud Required
KeePass stores your password vault as an encrypted file on your local machine — no account, no cloud sync by default, no company with access to your data. The file uses AES-256 encryption with Argon2 key derivation, which is hardened against brute-force attacks on the master password itself.
KeePass's built-in password generator lets you configure character pools precisely: include or exclude specific characters, set minimum counts per character type, exclude homographs. The generator uses Windows CryptGenRandom (on Windows) or /dev/random equivalent for cryptographic randomness.
The practical limitation is synchronization. To use KeePass across multiple devices, you manage the vault file yourself: copy it to Dropbox, iCloud Drive, or a USB drive, and keep it consistent. KeePassXC (a cross-platform fork) and KeePass2Android handle the mobile side. This setup is more work than Bitwarden but provides complete offline operation.
KeePass is the right tool for users who need their password vault to exist nowhere except hardware they personally control — IT professionals handling sensitive client credentials, people in high-risk environments, or users who consider any cloud storage unacceptable regardless of encryption.
Browser Password Managers: The Single Point of Failure
Chrome, Safari, Edge, and Firefox all include built-in password managers. They are convenient: passwords auto-fill, generation happens at the login form, and sync across devices tied to your Google or Apple account works without setup.
The risk: browser-integrated password managers store credentials inside the browser process. If your browser is compromised by malware, every saved password is exposed simultaneously. One infection drains all accounts at once. Malware targeting browsers, specifically browser information stealers, reads the entire password database from local encrypted storage without needing your master password, because the browser decrypts the vault automatically when you unlock your device. Redline Stealer, Vidar, and similar malware families specifically target Chrome's login data file, which stores passwords in a SQLite database that Chrome decrypts using the Windows Data Protection API. Malware running in your user account can access DPAPI-protected data without any additional credentials.
A standalone manager like Bitwarden or KeePass encrypts the vault independently of the browser, requires a separate master password to decrypt, and isolates credentials from the browser process. If your browser is compromised, a standalone manager's vault remains encrypted.
For most home users, browser managers are fine for low-stakes accounts. For email, banking, work accounts, and any credential that could enable significant damage if stolen — use a standalone manager. Read more in our guide to free password managers.
Checking if Your Existing Passwords Are Already Burned
Generate new passwords only for accounts that actually need them. Before creating passwords: check whether your email has appeared in data breaches using haveibeenpwned.com or free breach monitoring alerts. If your email appears in a breach, assume the password you used on that service is burned — change it first, then rotate any accounts that used the same password.
Bitwarden's Vault Health Reports (free tier) scans your stored passwords against the HaveIBeenPwned API using k-anonymity — it checks without sending your actual passwords. Run this after importing or adding passwords to identify which ones need rotation first.
Honest Caveat
No password generator eliminates the human factor. The strongest generated password stored in a compromised manager (whether because your master password was weak or because malware extracted the vault file) provides no protection. Password generation solves one problem: creating credentials an attacker cannot guess. Protecting those credentials requires: a strong master password (20+ characters, not reused), two-factor authentication on your password manager account, and keeping your devices free of malware. The generator is the easy part.
Frequently Asked Questions
Does password length really matter more than complexity?
Yes. Entropy — the measure of password unpredictability — scales faster with length than with character variety. A 16-character lowercase password has more possible combinations than an 8-character password using every character type. Security researchers use this to show that "correct-horse-battery-staple" (4 random words, 28 characters) is far stronger than "P@ssw0rd" despite being entirely composed of dictionary words. Length multiplies the search space; complexity only adds to the character pool.
What specific settings should I use in Bitwarden generator?
For stored passwords in a manager: Length 16 minimum (20 preferred), uppercase on, lowercase on, numbers on, special characters on, "Avoid ambiguous characters" on (eliminates O/0, I/l/1 pairs that cause confusion on typed entry). For passwords you need to type manually, use passphrase mode: 4 words, capitalize first letter of each, separator hyphen. The generated passphrase is easier to type and cryptographically sufficient.
What is the single point of failure risk with browser password managers?
Browser-integrated password managers (Chrome, Safari, Edge) store your passwords inside the browser process. If your browser is compromised by malware, an attacker can extract all stored credentials by reading the browser\
Is KeePass safe to use?
KeePass is open-source software with a published security audit. It stores your password vault as an encrypted local file (AES-256 with Argon2 key derivation) that you control entirely — no cloud sync, no company with access to your data. The trade-off: synchronizing across devices requires setting up your own cloud storage (Dropbox, iCloud, Google Drive) manually. KeePass is the right choice for users who want zero reliance on a third-party server but have the technical comfort to manage sync themselves.
How often should I change passwords?
NIST guidelines (updated 2024) recommend against scheduled password changes. Forced rotation leads to weaker passwords — users increment numbers, add an exclamation mark, or make predictable changes. Change a password when: a service announces a breach involving your account, you suspect unauthorized access, or you shared the password with someone who should no longer have it. Otherwise, a strong unique password generated once is more secure than a mediocre password changed every 90 days.
Can the ToolsFree.ai password generator see my passwords?
No. The generator runs entirely in your browser using the Web Crypto API (crypto.getRandomValues). No password is sent to any server. The output exists only in your browser\