Last updated: October 2026
How to generate a strong password
Short answer: use at least 16 random characters drawn from uppercase, lowercase, numbers, and symbols — like the generator above produces. Randomness matters more than cleverness: a truly random 16-character password has about 103 bits of entropy, which no attacker can brute-force. Never reuse it anywhere else.
What makes a password strong
Password strength is measured in bits of entropy: bits = length × log2(character-set size). Each extra bit doubles the work an attacker must do. Length beats complexity — but both together win:
| Password style | Entropy | Verdict |
|---|---|---|
| 8 lowercase letters | ~38 bits | Weak — cracked in hours |
| 12 mixed characters | ~77 bits | Fair — fine for low-value accounts |
| 16 mixed characters | ~103 bits | Strong — the sweet spot |
| 20 mixed characters | ~129 bits | Very strong — overkill for most uses |
| 5-word passphrase | ~40 bits | Fair — good where sites rate-limit logins |
The strength meter above computes this live for every password it generates, so you always know exactly what you're getting.
Passphrases: easier to remember, still strong
A passphrase like correct-horse-battery-staple trades character soup for ordinary words — much easier to type and remember. The security comes from the word count, not the words themselves: each word from this tool's 240-word list adds about 8 bits of entropy. Five words (~40 bits) stops online guessing cold, since websites lock accounts after a few wrong tries. For anything an attacker could download and crack offline — your password manager master password, disk encryption — use six or more words, or a long random string.
Frequently asked questions
How random are the passwords this generates?
Fully random. The generator uses crypto.getRandomValues(), your browser's cryptographically secure random number generator, which draws from operating-system entropy — the same source of randomness used for TLS keys. Every character is unpredictable, with no patterns or repeats bias.
Can a generated password be hacked or guessed?
Practically, no. A 16-character password from the full character set has about 103 bits of entropy — an attacker would need around 2^103 guesses. Even at a trillion guesses per second, that takes far longer than the age of the universe. Shorter passwords are weaker, so the strength meter shows the exact entropy of every password you generate.
Why doesn't this tool use Math.random()?
Math.random() is a predictable pseudo-random generator designed for games and animations, not security — its output can be reverse-engineered from a few samples. Passwords need a cryptographically secure generator like crypto.getRandomValues(), which is what this tool uses for every single character.
Passphrase or random password — which is better?
Both are excellent when long enough. A 5-word passphrase from this tool's 240-word list has about 40 bits of entropy — fine against online guessing where sites rate-limit attempts, but weak against offline attacks. For important accounts, use 6+ words or a 16+ character random password (about 103 bits). Pick passphrases for passwords you must type or remember; use random strings everywhere else with a password manager.
Should I use a password manager?
Yes — it's the single biggest security upgrade most people can make. A manager lets you use a unique, strong, random password on every site without remembering any of them. Generate passwords here, store them in the manager, and you only ever need to remember one strong master passphrase.
What is password entropy?
Entropy measures password strength in bits: bits = length × log2(character-set size). Each extra bit doubles the number of guesses an attacker needs. A 16-character password from 87 possible characters has about 103 bits of entropy. The strength meter on this page computes it live for every password.
Is my data private?
Completely. Every password is generated locally in your browser with JavaScript — nothing is sent to a server, stored, or tracked. The recent-passwords history lives only in the page's memory and vanishes the moment you close or reload the tab.
What is a dictionary attack?
Instead of guessing blindly, attackers run through lists of common passwords, dictionary words, pet names, birthdays, and keyboard patterns like "qwerty" or "123456" — often millions of them in seconds. This is why P@ssw0r12d feels clever but falls quickly: it's still built on a dictionary word. A truly random password from this generator has nothing in any word list, so dictionary attacks simply can't touch it.
Should I check whether my password has been leaked?
Yes — a strong password is worthless if it's already sitting in a breach dump. Billions of real passwords have leaked from hacked sites over the years, and attackers try every leaked password against other services first. Free services like Have I Been Pwned let you check whether your password appears in known leaks. If it does, generate a fresh password here and change it on that account immediately — and use a different one everywhere else.
Do I still need two-factor authentication with a strong password?
Yes. Two-factor authentication (2FA) means a stolen password alone isn't enough to log in — an attacker also needs a code from your authenticator app or phone. Passwords can leak through breaches, phishing, or keyloggers no matter how strong they are; 2FA is the backup that stops a leaked password from becoming a hacked account. Turn it on for your email, bank, and password manager first.
Can I use this generator for security-question answers?
Absolutely — and you should. Answers like your mother's maiden name or your first school are guessable public facts, not secrets. Generate a random string here, use it as the "answer," and save it in your password manager next to that account. It makes security questions as uncrackable as the passwords themselves.