How to generate a strong password
- Choose a length. 16 characters or more is a good choice for important accounts.
- Tick the character types you want: uppercase, lowercase, numbers and symbols.
- Click New until you like the password, then click Copy.
- Save it in a password manager rather than reusing it on other sites.
What makes a password strong
Strength comes from length and randomness. The meter shows the estimated entropy, the number of guesses an attacker would need, expressed in bits:
| Entropy | Rating | Example |
|---|---|---|
| Under 40 bits | Weak | 6 characters, letters only |
| 40–59 bits | Fair | 8–10 mixed characters |
| 60–79 bits | Strong | 12 mixed characters |
| 80+ bits | Very strong | 16+ mixed characters |
Each extra character multiplies the work for an attacker. A 16-character password using all four character types has about 100 bits of entropy, far beyond what can be guessed.
How these passwords are made
The generator uses the Web Crypto API (crypto.getRandomValues), the cryptographically secure random source built into every modern browser, with unbiased sampling. Every character type you select is guaranteed to appear, and the result is shuffled. Passwords are created on your device and never sent or stored. Reload the page and they’re gone.
Good password habits
- Use a different password for every site. When one site is breached, attackers try the same email and password everywhere else.
- Use a password manager (such as Bitwarden, 1Password, Apple Passwords or Google Password Manager) so you don’t have to remember them.
- Turn on two-factor authentication or passkeys for email, banking and social media.
- Tick Avoid look-alikes if you’ll have to type the password by hand, for example on a TV.
Some older sites limit which symbols they accept. If a password is rejected, untick Symbols and increase the length instead.
Frequently asked questions
Are these passwords really random?
Yes. They are created with the Web Crypto API (crypto.getRandomValues), the same cryptographically secure random generator browsers use for encryption, and every selected character type is included.
Are the passwords stored or sent anywhere?
No. They are generated in your browser and disappear when you close the page. We never see them.
How long should my password be?
Use at least 12 characters, and 16 or more for email, banking and password-manager accounts. Length adds more strength than symbols do.
Should I use a password manager?
Yes. A password manager remembers a unique strong password for every site, so a leak on one site cannot unlock your other accounts. Turn on two-factor authentication for important accounts too.