What makes a secure password?
A secure password is long (16+ characters), uses a mix of uppercase, lowercase, numbers, and symbols, and is randomly generated rather than human-chosen. This tool uses the browser's Web Crypto API (crypto.getRandomValues) to produce truly random passwords that never leave your machine.
What makes a password strong
A password's strength comes from entropy — the number of possibilities an attacker must try. Entropy grows with both length and the size of the character set, but length matters most. A long password drawn from uppercase, lowercase, digits, and symbols is exponentially harder to brute-force than a short one, and a randomly generated password avoids the predictable patterns that make human-chosen passwords weak.
Because random passwords are impossible to guess from personal information and are never reused, they close the two most common ways accounts are compromised.
Using a password manager
Strong random passwords are not meant to be memorised. Generate a unique one for every account and store them in a password manager, so each login has its own long, random secret. Reusing one password everywhere means a single breach exposes every account; a manager plus a generator removes that risk entirely.
Passphrases as an alternative
A long passphrase of several random words can be as strong as a shorter symbol-heavy password and far easier to type on a phone. What matters is total entropy — enough length and randomness that guessing is infeasible. For secrets you must type by hand, a random passphrase is a practical, strong choice.
How to generate a secure password
- 1Set the length and character types. Choose a length — 16 or more is recommended — and which character sets to include.
- 2Click Generate. A random password is created instantly. Use Bulk to produce several at once.
- 3Save it in a manager. Copy the password and store it in your password manager for that account.
Examples
A 16-character password
Input
Length 16, all character types
Output
t7$Kp2@wR9nX!vLq
A longer passphrase-length secret
Input
Length 24
Output
F3&hM8xQ2!zP9vK5$rT7wN1c
Password strength factors
What raises the cost of cracking.
| Factor | Effect |
|---|---|
| Length | Biggest impact — aim for 16+ |
| Character variety | Larger set per position |
| Randomness | No guessable patterns |
| Uniqueness | One password per account |
| Symbols & digits | Expand the character set |
Frequently asked questions
How long should a password be?+
At least 16 characters for important accounts. Length adds strength faster than complexity, so a longer password beats a short but complicated one.
Are these passwords generated securely?+
They are created in your browser using the platform's cryptographic random source and are never transmitted or stored, so each password is known only to you.
Should I reuse a strong password?+
No. Reuse means one breach compromises every account that shares the password. Generate a unique password per account and store them in a manager.
Do symbols really make a password stronger?+
They enlarge the set of possibilities per character, which helps, but adding length is the more powerful lever. Use both where a site allows it.
Is anything sent to a server?+
No. Generation happens entirely on your device.
Is it free?+
Yes — free and unlimited.
How often should I change my passwords?+
Change a password when a service reports a breach or you suspect exposure. Routine forced changes tend to produce weaker, predictable passwords, so a unique strong password per site matters more.