1. Choose a length that fits the account
Open the free password generator and stay on the Password tab. ComplexPass starts at 12 characters. If the website accepts longer passwords, choose the Stronger · 20 preset or enter a length of at least 16 characters. Length can be adjusted from 4 to 128 characters, but the lowest settings are for compatibility, rather than a recommendation for account passwords.
CISA’s password guidance recommends long, random, unique passwords. A longer setting is especially easy to use when a password manager will store and fill the result for you.
2. Match the website’s character rules
Keep uppercase, lowercase, numbers, and symbols selected if the account accepts them. Under Advanced options, you can edit Allowed symbols or exclude a character the website rejects. There is no need to shorten the password just because a service does not accept one particular symbol.
Easy to read removes lookalikes such as I, l, 1, O, and 0. This can help when you must type a password manually. It also reduces the set of available characters, so keep the result long. Start with a letter and No repeated characters are optional compatibility choices; they are not requirements for every secure password.
3. Generate it without adding personal patterns
Press Regenerate to make a fresh random password, then Copy password. ComplexPass uses your browser’s Web Crypto random-number generator. It does not construct a password from your name, birthday, pet, or a familiar sentence.
Avoid editing the result into a pattern you use elsewhere. For example, putting the same memorable ending on every account makes those passwords related. If a result is awkward to type, adjust the settings and regenerate instead. For a password you need to remember, consider a random word passphrase.
4. Save a different password for each account
Store the result in your password manager under the correct account. Reuse connects accounts together: a password exposed by one service may also be tried against another. A fresh result for each account avoids that connection.
ComplexPass is a generator, not a password vault. Recent generations are held only in the open page and disappear when you refresh or close it. Remember my settings stores generator preferences, not your passwords. The clipboard and a downloaded text file are separate copies on your device, so treat both as sensitive.
5. Check the account’s other protections
After saving the password, use the account’s additional sign-in protection where available, such as a passkey or multi-factor authentication. A password can still be stolen through a phishing page or a compromised device, even when it is long and random.
If the website reports that your password has been exposed, generate a new one for that account. If you reused the old password elsewhere, replace those copies too. Read how password length affects guessing for help choosing a longer setting.