What makes a password strong?
Length matters most. Each extra character multiplies the number of possible passwords, so a 16-character password is vastly harder to guess than an 8-character one. Mixing uppercase, lowercase, numbers and symbols helps too, because it widens the pool of possible characters.
Randomness matters as well. Passwords based on names, dates or words with swapped letters (like P@ssw0rd) are among the first that attackers try. This generator uses your browser's built-in secure random number generator, the same kind used for encryption.
Good password habits
- Use a different password for every account. If one site is breached, your other accounts stay safe.
- Use a password manager to remember them. Most browsers and phones have one built in.
- Turn on two-factor authentication for email, banking and social media.
- Aim for at least 12–16 characters for important accounts.
What "bits of randomness" means
The strength meter estimates how many guesses an attacker would need, measured in bits. Each extra bit doubles the guesses. Above about 80 bits, a randomly generated password is far beyond what anyone could guess with today's computers.
Frequently asked questions
Is it safe to use an online password generator?
This one is. The password is created by code running in your own browser and is never sent over the internet or saved.
Why avoid look-alike characters?
Characters like a capital I and a lowercase l look the same in many fonts. Avoiding them helps if you need to read or type the password by hand.
How long should my password be?
At least 12 characters, and 16 or more for email, banking and other important accounts.