Password Generator

What Makes a Password Strong?

Password strength comes down to one thing: entropy — how unpredictable the password is to an attacker. The more entropy (measured in bits), the longer it takes to crack. A random 16-character password using uppercase, lowercase, numbers, and symbols has roughly 100 bits of entropy, which would take billions of years to brute-force on modern hardware.

How to Create a Strong Password

Follow these principles and your accounts will be dramatically harder to compromise:

1. Go long. Length beats complexity. A 20-character password of random words is stronger than a short, garbled one. Aim for at least 12 characters; 16+ is ideal.
2. Mix character types. Combine uppercase letters, lowercase letters, numbers, and symbols. Each type you add roughly doubles the character pool.
3. Avoid the predictable.Never use names, birthdays, "password123," keyboard patterns (qwerty), or anything found in a dictionary. Attackers try these first.
4. Use a unique password for every account. If one service is breached, attackers will try the same password on your email, banking, and social accounts.
5. Store them in a password manager. Trying to memorize dozens of strong passwords is impossible. Use a reputable manager (Bitwarden, 1Password, KeePass) to store them encrypted.

How Secure Is This Generator?

This tool uses the Web Crypto API (crypto.getRandomValues), which pulls randomness from your operating system's cryptographically secure random number generator. This is the same standard used by banks and security software. It is dramatically more secure than Math.random(), which is predictable and unsafe for passwords.

Even better: the password is generated entirely in your browser and is never transmitted anywhere. There is no server log, no database, and no tracking. Once you copy it, it lives only on your clipboard.

Understanding Password Strength Scores

The strength meter shown above estimates entropy based on your password's length and the size of the character pool used. Here's what each level means:

• Very Weak (<40 bits): Crackable in seconds to minutes. Never use for anything important.
• Weak (40–60 bits): Crackable in hours to days with consumer hardware. Upgrade your length.
• Strong (60–80 bits): Would take years to crack. Suitable for most personal accounts.
• Very Strong (>80 bits): Effectively uncrackable. Use for email, banking, and password manager master passwords.

Should I Memorize or Use a Manager?

For most people, a password manager is the right answer. The only password you need to memorize is the master passwordthat unlocks your manager — make it a long passphrase (4-5 random words) rather than a short complex string. Every other password can be a random 20+ character string generated here, since you'll never need to type it.

Frequently Asked Questions

Is it safe to use passwords generated online?

It depends on the tool. This generator runs entirely in your browser, so the password never touches a server. Avoid generators that send your password over the internet or store it in a database. When in doubt, you can view this page's source code and confirm everything happens client-side.

How often should I change my passwords?

Modern guidance from NIST (the U.S. standards body) says you no longer need to change passwords on a fixed schedule — only when there's reason to believe they've been compromised. What matters far more is using a strong, unique password for each account and enabling two-factor authentication.

What's the ideal password length?

For online accounts protected by rate limiting, 12-16 characters is plenty. For offline targets like encrypted drives or password manager master passwords, go longer — 20+ characters, since an attacker with the file can brute-force without rate limits.