What makes a password strong?
A strong password is long and truly random. Length matters most: every extra character multiplies the number of possible passwords an attacker has to try. Randomness matters because attackers don't guess letter by letter; they start with leaked password lists, dictionary words and common patterns like Summer2026!, which crack in seconds no matter how many character types they contain.
This generator creates passwords where every character is chosen independently and uniformly at random using your browser's cryptographically secure random number generator (crypto.getRandomValues), so there's no pattern to exploit.
How to use the generator
- Set the Length slider (8 to 64 characters; 16 is the default).
- Choose which character sets to include: uppercase, lowercase, numbers and symbols.
- Click Generate, then copy the password straight into your password manager.
If you turn every set off, the generator falls back to using all of them rather than producing an empty password.
How strong is a generated password?
Password strength is measured in bits of entropy: each bit doubles the number of guesses needed. With all four sets enabled there are 76 possible characters, so each character adds about 6.2 bits.
| Length | Entropy (all sets) | Average time to brute-force* |
|---|---|---|
| 8 characters | ~50 bits | about 1.5 hours |
| 12 characters | ~75 bits | about 5,900 years |
| 16 characters (default) | ~100 bits | about 200 billion years |
| 20 characters | ~125 bits | longer than the universe has existed, many times over |
*Assumes an attacker making 100 billion guesses per second, which is realistic for a GPU cluster attacking a leaked database protected by a fast, unsalted hash. Websites that hash passwords properly (bcrypt, scrypt, Argon2) slow this down by many orders of magnitude.
Removing character sets lowers the entropy per character: lowercase only gives 4.7 bits per character, and letters plus numbers give about 5.95. You can make up for it with length. A 20-character lowercase password (~94 bits) is roughly as strong as a 15-character password using every set.
What the current guidelines recommend
The U.S. National Institute of Standards and Technology's digital identity guidelines, NIST SP 800-63B, are the standard most security teams follow. The current version:
- requires passwords used as the only authentication factor to be at least 15 characters (8 when combined with multi-factor authentication),
- says sites should accept passwords of at least 64 characters,
- advises against composition rules like "must contain a symbol", since long random passwords make them unnecessary,
- advises against forced periodic changes, unless there's evidence a password was compromised.
Tips for using generated passwords
- Use a different password for every account. Reused passwords are the main way one data breach turns into many. That's only practical with a password manager, which is also where generated passwords belong.
- Turn on multi-factor authentication wherever it's offered, especially for email, which can be used to reset everything else.
- Check an existing password with the password strength checker. It runs in your browser too.
Need a random identifier rather than a password? The UUID generator creates random version 4 UUIDs, and the hash generator computes SHA-256, SHA-384 and SHA-512 checksums.
Last updated