Use one password for one account
A long password reused across several accounts can turn one breach into several account takeovers. Create a distinct password for each login, especially for your email, banking, work, and password-manager accounts.
1. Generate a new value instead of adapting an old one
Avoid changing a familiar password by adding a year, a symbol, or a site name. It is easier to make a completely new value and save it before you leave the sign-up page.
Create the password on a device you trust, then use it for one account only.
Use the destination’s own requirements; do not weaken a generated value just to make it memorable.
If a service offers passkeys, consider its guidance and your own device-recovery plan before choosing one.
Got A Tool's Password Generator uses the browser's cryptographic random source and lets you choose the character groups. It shows the result only in the current tab; it does not create an account or save the password for you.
2. Store it before you continue
A trusted password manager is designed to keep unique passwords available when you need them. Save the account name, the sign-in address, and any recovery information while the setup screen is still open. Confirm that you can find the saved entry before you sign out.
Useful to keep together
The exact login URL, account name, generated password, and a note that helps you identify the service later.
Keep with extra care
Recovery codes, backup methods, and password-manager recovery details. They can be as powerful as the password itself.
Do not treat a password as ordinary text
Do not paste a password into a support chat, an AI prompt, a public document, or an unapproved messaging channel. If an account must be shared, use the account owner's approved sharing method or create a limited, revocable account where the service supports one.
3. Finish the account's other protections
A unique password is one layer. Add the account's available multi-factor authentication, review its recovery address and phone number, and remove old devices or sessions if you no longer use them. These steps are controlled by the service, so follow its current account-security instructions.
- Test that the saved password works before you close the original setup page.
- Store recovery codes where only you can reach them; do not leave them in a shared downloads folder.
- If you think a password was exposed, change it at the account itself and review active sessions.
What a password generator cannot decide
It cannot verify that a website is legitimate, recover a lost account, choose your password manager, or secure a device that someone else controls. Check the sign-in address carefully and follow the account provider's security process when something looks unusual.
Common questions
Should I change every password regularly?
Follow the rules for the account and your organisation. In general, change a password promptly when you suspect it was exposed, and keep it unique so an issue with another service does not automatically affect this account.
Can I write a password down?
That depends on where it will be stored and who can access it. A visible note, screenshot, or unprotected document can expose it. Use a storage method that fits the account’s importance and your environment.
Does this guide replace account-security advice from my bank or employer?
No. Financial institutions and workplaces can have their own required tools, recovery steps, and sharing rules. Follow their instructions for those accounts.