What makes a password strong
A strong password is one an attacker cannot guess before they give up. Attackers do not guess letter by letter. They start with lists of leaked passwords, then common words with numbers added, then patterns like Summer2025!, and only then brute force. So the two things that matter most are:
- Randomness. If a human picked it, it follows a pattern. If a cryptographic random generator picked it, it does not.
- Length. Every extra character multiplies the work. A random 16 character password with letters, digits and symbols has about 105 bits of entropy. At 10 billion guesses a second that still takes longer than the age of the universe.
Symbols help a little. Length helps a lot. That is why this generator defaults to 20 characters.
How long should a password be?
| Use | Recommended | Why |
|---|---|---|
| Accounts saved in a password manager | 20+ random characters | You never type it, so length is free. |
| Password manager master password | 6 to 7 word passphrase | You type it every day, so it must be memorable and very strong. |
| Wi-Fi password | 5 word passphrase or 16+ characters | Wi-Fi handshakes can be cracked offline. |
| Phone or card PIN | 6 digits, not a date | The device limits attempts, so short is fine if it is random. |
Is this generator safe to use?
Yes, and you can check it yourself. The password is created by crypto.getRandomValues, the same random source browsers use for encryption keys, with rejection sampling so every character is equally likely. The page makes no network requests when you generate or check a password, works offline once loaded, and has no analytics or ads. Open your browser's network tab and see.
After you generate a password, save it in a password manager like Bitwarden, 1Password, Apple Passwords or the one built into your browser. Use a different password for every site, so one breach does not unlock the rest.
Frequently asked questions
Do you store or see the passwords I generate?
No. Passwords are generated with JavaScript in your browser and never leave your device. There is no server call, no log and no analytics on this page.
Is a passphrase better than a random password?
For passwords you have to remember and type, yes. Six random words from a 7,776 word list give 77 bits of entropy and are much easier to remember than 13 random characters with the same strength. For passwords stored in a password manager, a long random password is best.
How many characters should my password have?
At least 12 for anything that matters, and 16 to 20 if you use a password manager. Length adds far more strength than swapping letters for symbols.
Are symbols required for a strong password?
No. Length and randomness matter most. Some sites require symbols, so the option is on by default, and you can turn it off for sites that reject certain characters.
What does 'no look-alikes' do?
It removes characters that are easy to confuse when reading or typing, like capital I, lowercase l, the digit 1, capital O and zero. Use it for passwords you have to read out or type from paper.
How do I know if my password has been leaked?
Use our free Password Leak Check. It compares your password against more than 900 million leaked passwords without ever sending the password itself.