Password generator

Why this sits next to temporary email

Signups need two things: an address and a password. A disposable inbox handles the address — you receive the verification mail, complete the flow, and the inbox expires. That leaves the password, and most people invent something weak under time pressure.

The risk is specific: if you register a throwaway account with a password you use elsewhere, you have created a real credential against a service you do not trust. When that service is breached — and many low-trust trial services are not well-secured — the credential gets tested against accounts that matter. Password reuse across a disposable signup and a real account is a path from "harmless trial" to "real account compromised."

The right pattern: generate a fresh, unique password for every throwaway registration. Store it in a password manager labeled as disposable if you might return. If you never return, losing the credential costs nothing. Use a full password manager for anything long-term. Use this generator when you need a strong, unique credential quickly — especially for trials and test accounts you expect to abandon.

How generation works

The tool draws randomness from crypto.getRandomValues in your browser — the same API used by cryptographic libraries. You choose length and which character classes to include: uppercase, lowercase, numbers, symbols, plus an optional "avoid ambiguous" filter that removes lookalikes like 0/O and 1/l. The string is not uploaded to Thirtel.

• Default length 20 — strong for random alphabets without being painful to paste or type.
• Character classes — turn sets off when a signup form rejects symbols or numbers; keep length high to compensate.
• Avoid ambiguous — useful if you might need to retype the password from a screen, such as when pasting into a device that does not share a clipboard.
• 8–64 range — covers most site policies without becoming unusable.

Generation guarantees at least one character from each selected class, which satisfies "must include a number" and "must include a symbol" rules without a separate complexity toggle. Modern guidance prioritizes length over complexity theater — a 20-character random string from four character classes is not meaningfully weakened by removing a rule that forces a digit in position three.

We intentionally skip minimum-per-class controls. Those shrink the random search space while providing the appearance of security. If a site requires a minimum of two numbers, turning off numbers entirely is a better signal to use a different site than adding a minimum-two-numbers slider to the generator.

What entropy actually means for passwords

A password's strength is roughly the number of equally likely candidates an attacker would need to test to find it. Length multiplies this more than character class does. A 20-character password from lowercase only has about 94 bits of entropy. Adding uppercase, numbers, and symbols brings it to about 131 bits. Both are far beyond what any attack can reach in a realistic window. A 12-character password with all classes has about 79 bits — significantly less.

The practical upshot: increase length before worrying about character classes. If a site imposes a maximum length below 16, that is a red flag about their password storage — sites that hash passwords correctly have no reason to limit length. Do not reuse the generated password anywhere else, and do not use it for accounts you intend to keep without storing it in a manager.

Throwaway signup checklist

1. Open a Thirtel Inbox and copy the address.
2. Generate a password here and copy it.
3. If you might return to this service, save both in a password manager labeled as disposable.
4. Fill the signup form with the temp address and generated password.
5. Verify from the inbox, then let the mailbox expire.

If you also need a name, username, or birth year for the form, the test identity tool generates synthetic values client-side. More detail: Temporary email and strong passwords.

What this is not

This is not a "temp Gmail account with password" service. Thirtel does not create Google accounts, generate stored credential bundles, or sell recycled login pairs. If a site requires a durable Gmail address, use a real Google account you control — or a separate alias service for situations where trust and longevity matter. If a site promises you a ready-made Gmail-plus-password package, that package is either fictitious or sourced from compromised accounts.