Every password is generated in your browser using crypto.getRandomValues(), the platform's cryptographically secure random source. Nothing is transmitted, nothing is logged, and no server ever sees the result. You can confirm that by disconnecting from the network — the page keeps working.
That is not a small detail. A generator that produces passwords server-side has, by definition, seen every password it made for you.
Entropy measures how many guesses an attacker needs, expressed in bits. Each additional bit doubles the work. Roughly:
Length buys far more than complexity does. A 20-character lowercase-only password beats a 10-character one using every symbol on the keyboard, and it is easier to type.
Six random words from a list of 4,096 give 72 bits of entropy and are dramatically easier to type on a phone or read aloud down a phone line — which matters more than people admit when you are talking a client through a wifi key. The catch is that the words must be randomly chosen. Words you picked yourself are worth a fraction of the entropy, because you did not pick them randomly.
In order of impact: a password manager so every password is unique, MFA on everything that supports it, and length. Forced ninety-day rotation is not on that list — NIST dropped that guidance years ago, because in practice it produces Summer2024! becoming Autumn2024!.
We are a Keeper MSP Partner, and Keeper is what we deploy and manage for Central Oregon businesses — provisioned, enforced and supported by us, not handed over as a login and a hope. Zero-knowledge encryption, enforced policy, shared vaults for teams, and dark-web monitoring on your domains.
Generating strong passwords is the easy half. The half that actually changes your risk is every person in the business using unique credentials without being asked to remember them — which is what a managed password manager does, and what a shared spreadsheet does not.
Being an MSP partner means we handle provisioning, policy, onboarding and offboarding as part of managed IT. When someone leaves, their vault access ends the same day rather than whenever somebody remembers. When a credential turns up in a breach dump, we hear about it.
Before you buy a password manager for your business, talk to us. Seats bought direct are seats nobody is administering — no enforced policy, no onboarding, no offboarding, and no one watching the breach alerts. We provision it, set the policy, train your people and support it, for a cost that is usually close to the sticker price of the licences on their own.
Already running 1Password, Bitwarden or something else? Keep it. We will take over administering what you have rather than push you through a migration you do not need. The conversation is worth having either way — what we would genuinely push back on is a shared spreadsheet, a notes app, or passwords saved in the browser, which is what we still find most often.
If you are working out password policy for a business rather than a single account, that is part of cybersecurity consulting.
We do managed IT, networking and security for businesses across Central Oregon.
Managed IT Services Call 541-508-8797