What makes a password strong?
Password strength is measured in entropy — how many guesses an attacker would need. Every extra character multiplies the number of possibilities, so length matters more than complexity. A random 16-character password using letters, numbers and symbols has about 105 bits of entropy; even at a trillion guesses per second it would take far longer than the age of the universe to crack.
| Entropy | Rating | Good for |
|---|---|---|
| Under 40 bits | Weak | Nothing important |
| 40–60 bits | Fair | Low-value accounts |
| 60–80 bits | Strong | Most online accounts |
| 80+ bits | Very strong | Email, banking, password manager master password |
Random password or passphrase?
Random passwords like q7#Vt!2mLx9@pR4s are the strongest per character — ideal when a password manager remembers them for you. Passphrases like Maple-River-Cloud-Tiger-42 are easier to type and remember, and are strong when the words are chosen randomly. Use a passphrase for the few passwords you must remember, such as your computer login or password manager.
Password security checklist
- Use a different password for every account. When one site is breached, attackers try the same password everywhere.
- Use a password manager so you only need to remember one strong passphrase.
- Turn on two-factor authentication (2FA) for email, banking and social media.
- Never share passwords by SMS, email or chat, and be wary of login pages reached through links.
How this generator keeps you safe
Passwords are generated with crypto.getRandomValues(), the browser's cryptographically secure random number generator, and the generator removes bias so every character is equally likely. Nothing is transmitted or saved — refresh the page and the password is gone.
Frequently asked questions
Is it safe to use an online password generator?
This one runs entirely in your browser using a cryptographically secure random generator, and nothing is sent over the internet. You can even disconnect from the internet after loading the page.
How long should my password be?
At least 12 characters for everyday accounts and 16 or more for email, banking and your password manager.
Are passphrases secure?
Yes, when the words are chosen randomly. A 5-word random passphrase from a large word list is very strong and much easier to remember.
Should I change my passwords regularly?
Current guidance (for example from NIST) says change passwords when there is a sign of compromise rather than on a fixed schedule — but always use unique passwords.