Articles
Where generated passwords help, where they do not, and how to pick the right kind of secret for each situation. No theory for its own sake — each piece ends with the exact settings to use.
Use cases
Choosing a master password for your password manager
The one password that protects all the others: why a passphrase usually wins, what to avoid, and how to memorise it without writing it anywhere online.
Password rotation: when changing a password actually helps
Forced 90-day rotation is no longer best practice. Here is when rotation really protects you, and when it only creates predictable variations.
Wi-Fi, routers and smart devices: passwords you actually have to type
Secrets that get typed on TV remotes and shared with guests need different settings from the ones a password manager fills in for you.
Passphrases or random passwords? Pick by where you type it
Two shapes of secret, two jobs. A short table of use cases, plus the entropy maths behind why length beats symbol soup.
Storing password hashes: Argon2id, bcrypt and what the output means
How to read a PHC string, why a salt is per-user, what bcrypt's 72-byte limit means in practice, and when verification replaces "remembering".
Passwords in code
The same job, in six languages: generate with the language's CSPRNG, hash with Argon2id or bcrypt, verify safely — plus the traps that are specific to each ecosystem.
Generating and hashing passwords in PHP
random_int() for generation, password_hash() with PASSWORD_ARGON2ID or PASSWORD_BCRYPT, and password_needs_rehash() to migrate parameters quietly.
Generating and hashing passwords in Python
The secrets module, argon2-cffi with explicit memory and iteration counts, bcrypt's checkpw(), and why passlib is no longer the safe default.
Generating and hashing passwords in Java
SecureRandom, Spring Security's Argon2 and BCrypt encoders (plus the BouncyCastle dependency), argon2-jvm, and keeping passwords out of String.
Generating and hashing passwords in Go
crypto/rand with rejection sampling, x/crypto/argon2 producing PHC strings, and the verification pitfall that turns into a denial of service.
Generating and hashing passwords in Rust
OsRng and gen_range() instead of a biased modulo, the argon2 crate for PHC output, and error handling that does not unwrap in production.
Generating and hashing passwords in C++
libsodium's randombytes_uniform() and crypto_pwhash_str() for Argon2id, and why hand-rolled bcrypt is not worth the risk.
Need a secret for any of these scenarios? Open the password generator — everything is created in your browser, and nothing is stored. Comparing your implementation's output against another? Use the hash and verify tools.