How to generate a strong password
- Choose Password for a random string of characters, or Passphrase for a series of random words that is easier to type and remember.
- Set the length. 16 characters or more is recommended for important accounts.
- Choose which character types to include. Turn on “avoid look-alikes” if you will need to read or type the password by hand.
- Press Copy and paste the password into the sign-up form — and into your password manager.
What makes a password strong?
A strong password is long, random and unique. Strength is measured in bits of entropy: each extra bit doubles the number of guesses an attacker would need. The strength meter above calculates entropy from the length and the number of possible characters:
Entropy (bits) = length × log₂(number of possible characters)
A 16-character password using upper and lower case letters, numbers and symbols (about 90 possible characters) has roughly 104 bits of entropy — far beyond what any computer could guess.
| Entropy | Strength | Example |
|---|---|---|
| Below 40 bits | Weak — can be cracked quickly offline | 8 lowercase letters |
| 40–60 bits | Fair | 10 mixed characters |
| 60–80 bits | Strong | 12 mixed characters, or a 5-word passphrase |
| 80+ bits | Very strong | 16+ mixed characters, or a 7-word passphrase |
Passwords vs. passphrases
A passphrase such as Canyon-Pepper-Violet-Orbit-Lantern7 is made of randomly chosen words. Because the words are picked at random from a large list, it is very hard to guess, yet much easier to remember and type on a phone than k#9Tq!v2Lp@x. Passphrases are ideal for the few passwords you must remember, such as your computer login or your password manager’s master password.
Words are drawn from the EFF Long Wordlist of 7,776 words (licensed CC BY 3.0 US), so each word adds about 12.9 bits of entropy.
Is this generator safe?
Yes. Passwords are created with crypto.getRandomValues(), the cryptographically secure random number generator built into every modern browser — not the predictable Math.random(). Generation happens entirely on your device; the passwords are never sent over the internet, logged or stored.
Password best practices
- Use a different password for every account. When one site is breached, attackers try the same email and password on other sites (“credential stuffing”).
- Use a password manager to remember them for you. Most browsers and phones include one, and dedicated managers such as Bitwarden and 1Password work across devices.
- Turn on two-factor authentication (2FA) for email, banking and social media. It protects you even if a password leaks.
- Don’t change strong passwords for no reason. Current NIST guidance recommends changing them only when there is evidence of compromise.
- Avoid personal information such as names, birthdays and phone numbers — these are the first things attackers try.
Frequently asked questions
How long should my password be?
At least 12 characters, and 16 or more for important accounts such as email and banking. Length matters more than complexity.
Are the passwords stored or sent anywhere?
No. They are generated in your browser and never leave your device. Once you close the page, they are gone.
Is a passphrase as secure as a random password?
A random passphrase of five or more words from a large word list is strong and much easier to remember. Use six or seven words for very sensitive accounts.
Why avoid look-alike characters?
Characters like 0 and O, or 1, l and I, are easy to confuse when reading a password aloud or typing it from paper. Excluding them slightly reduces strength, so use a longer password to compensate.
What random generator does this use?
It uses crypto.getRandomValues(), the browser’s cryptographically secure random number generator, with unbiased selection of each character.