A signup form rejects your new password even though a generator calls it strong. One possible problem is a mismatch between the selected characters and the account rules. Start with those rules, generate a fresh value, and keep it in a password manager rather than trying to make an old password fit.
This guide uses a fictional account that accepts 16 to 64 characters, allows only letters and digits, and requires an uppercase letter, a lowercase letter and a digit. We will generate 20 characters for that example. This is a practical choice within the example limits, not a universal password standard.
Read the account rules before generating
Check the signup page or official help page for four details: minimum length, maximum length, permitted characters and any required character types. A list of permitted symbols is different from a requirement to include a symbol. If the instructions are unclear, check the service documentation before repeatedly changing the password.
For the fictional account, write a settings checklist containing only these non-secret requirements:
- Length: 20 characters, within the stated 16 to 64 range.
- Allowed: uppercase letters, lowercase letters and digits.
- Required: at least one character from each of those three groups.
- Symbols and spaces: not allowed in this example.
Do not write the eventual password into that checklist or a shared support ticket.
Set up the Password Generator for this example
- Open the Password Generator and move the length slider to 20.
- Enable Lowercase, Uppercase and Digits. Leave Symbols off because the example service does not accept them.
- Keep the rule requiring at least one character from every selected set enabled. Selecting a set alone allows its characters; the separate rule requires their inclusion.
- Choose one password, then press Generate. Check the output length and required character types privately.
- Use Copy to transfer that one value into a new entry in your password manager, then use the saved entry for the correct account.
The tool supports lengths from 4 to 64 and batches of 1, 5 or 10. Its lowest available setting is a tool capability, not a recommendation. Use one result when creating one account so you do not accidentally copy several lines into a password field.
When symbols or look-alike characters matter
The Symbols checkbox uses a broad fixed set. There is no control for allowing only a custom subset such as three particular symbols. If an account requires a symbol but accepts only a narrow list, use a password manager or generator that can express that exact list. Do not assume every result from this checkbox will be accepted.
The look-alike option removes lowercase l, digit 1, uppercase I, uppercase O and digit 0. It can make manual entry easier, but it does not replace the account rules. Confirm any required groups are still present.
If the form rejects the result
Read the exact rejection message. Check that you copied a single result, stayed within both length limits and selected only permitted groups. Correct the settings and generate a fresh candidate. Avoid adapting an old password by adding a predictable digit or punctuation mark.
Requirements differ between services. NIST SP 800-63B-4, written for digital authentication within its government-system scope, tells covered verifiers not to impose mixtures of character types. That does not mean a signup form you encounter has already adopted those rules. Match the actual form without treating its restrictions as a universal security recipe.
Store a unique password and enable MFA
Use a fresh password for each account. CISA password guidance describes long, random, unique passwords and using a password manager to generate and store them. Do not reuse a published example or post your generated value in a screenshot.
Save the entry under the correct service address and verify that the saved value works before discarding your temporary copy. Enable multifactor authentication in the account security settings when available. A password and an additional authentication factor address different parts of account protection.
Know what the displayed score cannot prove
The generator displays bits and a strength label. These do not establish that a service accepts the result, that it has never appeared elsewhere, or that an account cannot be compromised. They are not a cracking-time promise. Review the actual constraints and storage process instead of chasing a label.
For software testing, an identifier serves a different purpose: see the UUID v4 test-data guide. A test record ID should not be substituted for an account password simply because it looks random.