Password Generator

Yes. They use the browser's cryptographically secure random generator, not a predictable pseudo-random source.

No. Passwords are generated locally in your browser on Toolvore and are never transmitted or logged.

For most accounts, 16+ characters with mixed types is strong. Longer is better, especially for high-value accounts.

Yes — free and unlimited, no signup.

Two usual causes. Some sites cap the length, and a signup form that accepts a long password can sit in front of a login form that silently truncates it, which locks you out of an account you have just created. Others allow only certain symbols. The set used here is ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > ? / with no spaces, quotation marks, backslashes, apostrophes or pipes, so a site demanding one of those needs you to add the character yourself. When a site refuses without explaining, shorten the password first, then untick Symbols and try letters and numbers alone.

Change it on the site that leaked it, then on every other account where you used the same password or a small variation of it — that reuse is what turns one leak into several compromised accounts, because leaked email and password pairs get replayed against other services automatically. Do your email account early, since whoever controls it can request reset links for everything else. Turn on two-factor authentication wherever the affected sites offer it. If you cannot recall which accounts shared that password, that is the moment a manager earns its keep, because it can list them for you.

It is far safer than the realistic alternative, which is reusing one password you can remember everywhere. The gaps are worth knowing. A browser store is tied to that browser, so moving between Chrome, Safari and Firefox, or into an app that is not a browser at all, leaves you copying by hand. On a shared or unlocked computer, saved logins are available to whoever sits down at it. A dedicated manager adds a master password, works across devices and applications, and can flag which of your passwords are reused. Whichever you use, guard the account it lives in — everything else hangs off it.

Yes. The second factor guards the login form, and the login form is not the only way in. Services get breached and their stored password hashes are cracked offline, where guessing is unlimited and fast; a common or short password falls to that and a long random one does not. Second factors vary in strength too — codes sent by SMS can be redirected by someone who persuades a network to move your number to a new SIM, and approve-this-login prompts get tapped through by people who are tired or busy. Treat them as two separate locks rather than one replacing the other.

Yes, and it matters more than length does. When a site is breached, the stolen list is tried automatically against every other service, so one reused password turns a single company's bad week into your problem across a dozen accounts. This is the reason a password manager exists: it makes uniqueness free, because you are no longer the one remembering them. If you cannot get to that today, start with the accounts that can reset the others — your email above all, then the phone account and the manager itself.