What makes a password strong?
Strength comes from how many passwords an attacker would have to try, which is measured in bits of entropy. Every extra bit doubles the work. Length matters far more than complexity: a random 20-character password from letters, digits and symbols has about 127 bits, while an 8-character one has about 50 bits and can be guessed in hours if a site's password database leaks.
- Under 60 bits: fine for a PIN-protected device, too weak for an online account whose database might leak.
- 70–80 bits: good for most accounts.
- 100+ bits: suitable for password manager master passwords, encryption keys and admin accounts.
The estimate on this page assumes the attacker knows exactly how the password was generated and can try 100 billion guesses per second, which is realistic for a stolen database protected by a fast hash. Well-run sites use slow hashes, so real attacks are usually much slower.
Password or passphrase?
A random password packs the most strength into the fewest characters. It's the best choice when a password manager fills it in for you.
A passphrase such as Cactus-Umbrella-Oxygen7-Lantern-Velvet is easier to type on a phone and to remember. Each word is picked at random from the EFF's list of 7,776 common words, adding about 12.9 bits per word, so five words give around 65 bits and six words about 78. Use passphrases for the few things you must type from memory: your computer login, your password manager and your email.
Is it safe to generate passwords online?
This page never sends or saves the password. It uses crypto.getRandomValues, the same secure random source browsers use for encryption, and rejection sampling so every character is equally likely. You can disconnect from the internet after the page loads and it keeps working. Even so, the safest habit is to let a password manager both create and store your passwords.
Good password habits
- Use a different password for every site. Reused passwords are the main way accounts get taken over after another site is breached.
- Store them in a password manager, such as the one built into your browser or phone.
- Turn on two-factor authentication or passkeys where offered, especially for email and banking.
- Don't rotate strong passwords on a schedule; change them when a service reports a breach.
Frequently asked questions
How long should a password be?
At least 16 characters for random passwords you store in a password manager, and at least 5 or 6 words for a passphrase you need to remember. Longer is always stronger.
Are these passwords really random?
Yes. They come from your browser's cryptographically secure random generator (crypto.getRandomValues). Each character or word is chosen with equal probability, and the order is shuffled so the guaranteed characters don't sit in predictable places.
Why exclude look-alike characters?
Characters such as I, l, 1, O and 0 are easy to confuse when a password has to be read aloud or typed from paper. Excluding them costs a little strength, so add a character or two of length to make up for it.
Why does a site reject my password?
Some systems don't allow certain symbols or limit the length. Add the rejected characters to "Never use these characters", or untick Symbols and increase the length instead.
Do you store the passwords?
No. Passwords are created in your browser and are never sent to a server or saved. Only your settings, such as length, are remembered in this browser.