16

…

—

Generated entirely in your browser with the Web Crypto API (crypto.getRandomValues) — nothing is sent to any server, and nothing is stored. Around 80+ bits of entropy is comfortably strong for anything you self-host; length matters more than symbols, so when in doubt, slide it right.

Password hygiene for a server

Every service on your server deserves its own password, because a reused one turns any leak anywhere into a breach everywhere. That is only practical with a password manager — and if you are already running a server, a self-hosted Vaultwarden gives you one that never leaves your hardware. Pair it with SSH keys for shell access and you rarely type a password at all.

About the entropy score: it measures how hard the password is to guess by brute force, and length is the cheapest way to raise it — 16 random characters already clear 90 bits. Turn off symbols and a long passphrase-style string still beats a short complicated one, which is why the slider, not the checkboxes, is the most important control on this page.