Password security comes down to entropy — how many possible combinations exist. A 12-character password using uppercase, lowercase, digits, and symbols has roughly 72 bits of entropy, making brute-force cracking impractical with current hardware.

Common attacks include brute-force (trying every combination), dictionary attacks (using word lists and leaked passwords), and credential stuffing (reusing passwords from breached databases on other services).

Best practices: use a unique password for every account, enable multi-factor authentication, and store everything in a password manager. This generator runs entirely in your browser — nothing is sent to any server.