How to Generate a Strong Password (and How Long It Should Be)
The most common passwords in every breach list are still things like "123456" and "password", and the second most common pattern is a favourite word plus a year plus "!". Attackers try those first. Password generator makes genuinely random passwords or passphrases and tells you how strong they are in bits.
Two kinds
Random characters: 8 to 64 characters from the sets you choose (lowercase, uppercase, digits, symbols). At least one character from each set you keep, the rest drawn from all of them, then shuffled. Ideal for anything stored in a password manager.
Passphrase: 3 to 12 random words from the EFF short word list (1,296 words, about 10.3 bits of entropy each), with optional capitals and a digit. Ideal for the handful of passwords you actually have to type and remember: your laptop login, your password manager's master password, your phone.
Steps
- Choose random characters or a passphrase.
- Set the length and character sets, or the number of words and the separator.
- Press New password and copy it.
Each press makes a fresh one, with its strength line.
How strong is strong enough?
The strength line shows entropy in bits. Each extra bit doubles the guesses needed. Roughly:
- Under 50 bits: weak for anything that matters.
- 60–80 bits: solid for most online accounts.
- 80+ bits: very strong.
Good defaults: 16+ characters with several sets, or a passphrase of 5 or more words. A 6-word passphrase is about 62 bits from the words alone, and it's far easier to type on a phone than x7#Qp!2vL@9z.
Lookalikes
Characters like 0, O, 1 and l are left out by default, because they're easy to misread when you have to type a password from one screen into another, or read it to someone. Tick Include lookalikes if you want them.
Where the randomness comes from
The browser's crypto API, which is designed for security purposes, not Math.random(). That matters: predictable randomness makes "random" passwords guessable.
Habits that matter more than any generator
- One password per site. Reuse is how one breached forum leads to a hijacked email account.
- Use a password manager. Bitwarden, 1Password, the one built into your browser or phone. Nobody remembers 100 random passwords.
- Turn on two-factor authentication for email, banking and anything with payment details.
- Change a password when a site reports a breach, not on an arbitrary schedule.
When a site rejects your password
Some sites have odd rules: no symbols, a maximum of 16 characters, a required symbol from a short list. The generator can't know a particular site's rules, so adjust the length or sets and generate again. If a site caps length at something tiny like 12, make full use of every character it allows.
Why random beats clever
Human-made passwords follow patterns: a capital at the start, numbers at the end, a symbol swapped for a letter ("P@ssw0rd"). Cracking tools know those patterns and try them first, so "clever" substitutions add very little. A generated password has no pattern to exploit; the only way in is brute force, and the bit count tells you how long that would take. That's the whole reason to let a machine choose.
Privacy
The page says passwords are created in the tab and aren't uploaded or saved. The page also carries Google ads, as across the site; for a fully offline habit, your password manager's built-in generator works too.
FAQ
Can it make a passphrase? Yes, choose Passphrase (words).
How long should a password be? 16+ characters with several sets, or 5+ words.
Can the site see my password? No, it's made with the browser's crypto API and stays on the page.
Should I reuse a generated password? No, one per site, stored in a password manager.
Replace your weakest password today with one from Password generator.
— Alok Kumar Singh