They reused Welcome123.
Not as a joke password for a staging box. As the live password for Shopify admin, the company Gmail forwarder, and a Stripe login they “hardly ever open”. This turned up in a support cleanup on 2 November 2026. I sat on a call, shared screen, and watched them paste the same string into three password fields like it was a loyalty card number.
I’d pick a random generator over a clever phrase every time. Clever phrases feel safer. They’re not. They’re short, patterned, and easy to guess once one site leaks.
Open the Password Generator Creates the string in your browser. Nothing is uploaded.
What I changed on that call (exact steps)
I opened our Password Generator. Set length to 20. Left uppercase, lowercase, and numbers on. Turned symbols on. Unticked “lookalike characters” because this person still typed some passwords by hand on a laptop with a sticky 0 key. Generated once. Copied. Pasted into a password manager vault (they already paid for one; they just weren’t using it). Then rotated Shopify, then email, then Stripe. Twenty-ish minutes. Boring work. Necessary work.
After that I ran the old password through the Password Strength Checker for the teachable moment. Entropy estimate was embarrassing. Crack-time language on the screen did more than my lecture.
My 16-24 character rule (and when I break it)
Under 12 characters? I won’t defend it. 16 is my floor for anything tied to money or customer data. 20–24 if the site allows it and the person has a manager app. Bank sites that silently truncate at 12 characters still exist. That bugs me. When I hit one of those, I generate 12 with full character classes and I store it anyway. Bad ceiling. Not my ceiling to fix in an afternoon.
Do you need symbols on every password? Not always. Some older routers hate certain characters. For a Wi-Fi admin panel I generated last month, I turned symbols off and pushed length to 24 instead. Length beats punctuation theatre.
Where our generator is weaker than I’d like
It’s a generator. It doesn’t sync across devices. It doesn’t warn you that you reused a string last year. If you want that, use Bitwarden, 1Password, or whatever vault you already trust. I’ll say it plainly: our free tool is for creating a strong string quickly, privately, without making an account. It’s not a password manager. People who pretend a webpage replaces a vault are selling comfort.
Also, if JavaScript is blocked entirely, the page won’t help you. Rare on modern browsers. Still true.
Check the breach story, not just the random string
On that same cleanup I asked them to run the company email through the Email Breach Checker. Two older dumps showed up. That matched the “we’ve always used Welcome123” energy. Generating a strong password without rotating after a known breach is half a fix. Do both.
If you’re shopping the wider set, start from the tools directory and grab the security ones together. Less tab chaos.
What I’d pick for different people
For a solo founder with a manager app: 20 characters, all classes, store it, turn on 2FA. For a shared tablet in a shop: longer passphrase-style random with fewer symbols so staff can type it when the manager app isn’t open. For API tokens, use the generator at 32+ and never email the raw value. I’ve seen that last one happen. Twice. Same year.
My read is most small teams don’t fail because they can’t find a “strong password” blog post. They fail because typing Welcome123 feels faster than opening a vault. The generator only helps if the next click is “save in manager”, not “save in Notes app titled passwords lol”.
We finished the call. They promised to stop sharing one login in a WhatsApp group. I’ll believe it when the next audit is clean.