What makes a secure password?
A secure password is long (16+ characters), randomly generated rather than human-chosen, and used for only one account. This tool builds passwords in your browser with the Web Crypto API's cryptographically secure random number generator (crypto.getRandomValues), choosing every character with equal probability. Passwords are never sent anywhere: Share link saves only your settings, never a password.
What makes a password strong
A password's strength comes from entropy — the number of possibilities an attacker must try. Entropy grows with both length and the size of the character set, but length matters most. A long password drawn from uppercase, lowercase, digits, and symbols is exponentially harder to brute-force than a short one, and a randomly generated password avoids the predictable patterns that make human-chosen passwords weak.
A random password has no connection to your name, birthday, or favourite words, so it can't be guessed from personal information, and generating a new one for every account means one breach can't unlock the others. Those are the two most common ways accounts are compromised.
The strength meter shows the exact entropy of your settings: the base-2 logarithm of how many different passwords the generator can produce. It accounts for the rule that every selected character set appears at least once, so 16 characters from all 88 characters give about 103 bits, and 20 characters about 129 bits.
Using a password manager
Strong random passwords are not meant to be memorised. Generate a unique one for every account and store them in a password manager, so each login has its own long, random secret. Reusing one password everywhere means a single breach exposes every account; a manager plus a generator removes that risk entirely.
Passphrases as an alternative
A passphrase of several randomly chosen words can be as strong as a shorter symbol-heavy password and is far easier to type on a phone. Its strength also comes from entropy: each word picked at random from a 7,776-word list, such as the EFF's diceware list, adds about 12.9 bits, so six words give about 77 bits. The words must be chosen randomly, not by you. This tool generates character passwords, not passphrases; for secrets you must type by hand, a random passphrase is a practical, strong choice.
How to generate a secure password
- 1Set the length and character sets. Drag the slider, type a length from 4 to 128, or pick a preset (16 or more is recommended), and choose which character sets to include. Every selected set appears at least once.
- 2Click Generate. Each click creates a new password, and Bulk (10) creates ten at once. The strength meter shows the exact entropy of your settings.
- 3Copy it into your password manager. Use Copy next to a password (or Copy all for a batch) and save it in your password manager for that account.
Examples
A 16-character password
Illustration only: never use a password that has been published anywhere, including on this page.
Input
Length 16, all four character sets (about 103 bits of entropy)
Output
t7$Kp2@wR9nX!vLq
A 24-character password
Illustration only: generate your own instead of copying this one.
Input
Length 24, all four character sets (about 154 bits of entropy)
Output
F3&hM8xQ2!zP9vK5$rT7wN1c
Password strength factors
What raises the cost of cracking.
| Factor | Effect |
|---|---|
| Length | Biggest impact — aim for 16+ |
| Character variety | More choices per position: 88 with all four sets |
| Randomness | Every character chosen by a cryptographic random generator |
| Uniqueness | One password per account |
| Entropy | 80+ bits is strong; 128+ bits is very strong |
Frequently asked questions
How long should a password be?
At least 16 characters for important accounts. Length adds strength faster than complexity, so a longer password beats a short but complicated one.
Are these passwords generated securely?
Yes. Each password is built in your browser with crypto.getRandomValues, the Web Crypto API's cryptographically secure random number generator, and every character is chosen with equal probability. Passwords are never sent to a server or stored, so each one is known only to you.
Should I reuse a strong password?
No. Reuse means one breach compromises every account that shares the password. Generate a unique password per account and store them in a manager.
Do symbols really make a password stronger?
They enlarge the set of possibilities per character, which helps, but adding length is the more powerful lever. Use both where a site allows it.
Is anything sent to a server?
No password is. Passwords are generated on your device and stay there. Share link saves only your settings (the length and character sets), and opening the link generates new passwords with them.
Is it free?
Yes — free and unlimited.
How often should I change my passwords?
Change a password when a service reports a breach or you suspect exposure. Routine forced changes tend to produce weaker, predictable passwords, so a unique strong password per site matters more.
What does the entropy number mean?
It is the base-2 logarithm of how many different passwords your settings can produce: n bits means an attacker who knows your settings has up to 2^n passwords to try. It accounts for the rule that every selected character set appears at least once. 80 bits or more is strong, and 128 bits is beyond any practical brute-force attack.