What makes a password strong?
A strong password is hard to guess, because it is long and unpredictable. Attackers do not type guesses by hand. They use programs that try billions of combinations, common words and leaked passwords. A password that is random, long and unique to one account resists these attacks, while one built from a pet name, a birthday or a keyboard pattern does not.
Length matters more than complexity. Each extra character multiplies the number of possible passwords. Current guidance from NIST in the United States favors longer passwords over rules that force odd symbol combinations, and recommends against changing passwords on a schedule unless there is a reason to.
How to use the password generator
- Move the length slider. Sixteen characters is a good default, and longer is stronger.
- Choose the character types: capital letters, small letters, numbers and symbols.
- Optionally avoid look-alike characters such as I, l, 1, O and 0 if you will type the password by hand.
- Choose how many passwords you want and press Generate.
- Copy a password straight into your password manager or the account form.
How strength is measured
Strength is shown in bits of entropy. Entropy is the length of the password multiplied by the base-2 logarithm of the number of possible characters. A 12-character password drawn from 88 characters has about 77 bits, which is very hard to guess by brute force. As a rough guide, under 40 bits is weak, 40 to 60 is fair, 60 to 80 is strong and above 80 is very strong for online accounts.
These numbers assume that every character is chosen at random, which is what this generator does. A password you invent yourself usually has far fewer effective bits than its length suggests, because people follow patterns.
Good password habits
- Use a different password for every account, so one leak does not expose the others.
- Store passwords in a reputable password manager, so you only have to remember one strong master passphrase.
- Turn on two-factor authentication wherever it is offered.
- Do not share passwords by email or chat, and do not write them where others can see them.
- Change a password immediately if you suspect that the account or the site was breached.
Is it safe to generate passwords online?
It is safe here because of how the tool works. The password is created by JavaScript running on your device, using the browser's secure random source. Nothing is sent over the internet, logged or saved. Even so, only generate passwords on a device you trust, and remember that a site you visit cannot be better than the connection and the computer you use.
Passwords or passphrases?
A passphrase made of four to six random common words can be strong and easier to remember than a string of symbols, which makes it a good choice for the one password you must type from memory, such as a password manager master password. The words must be chosen randomly, not picked by you, and the phrase should be long. For everything else, let a password manager store a long random password.
Password strength by length (bits of entropy)
| Length | Letters and digits | Letters, digits and symbols |
|---|---|---|
| 8 | About 48 bits | About 52 bits |
| 12 | About 71 bits | About 78 bits |
| 16 | About 95 bits | About 103 bits |
| 20 | About 119 bits | About 129 bits |
Frequently Asked Questions
How long should a password be?
At least 12 characters for most accounts, and 16 or more for important ones such as email and banking.
Are symbols necessary?
They add strength, but length adds more. If a site does not allow symbols, make the password longer instead.
Are the passwords stored or sent anywhere?
No. They are generated in your browser and never leave your device.
Is a random password better than one I make up?
Yes. Random passwords are not affected by the patterns that people follow, which makes them much harder to guess.
How do I remember a random password?
You do not have to. Use a password manager, and remember only its master password.
What does avoiding look-alike characters do?
It removes I, l, 1, O, 0 and o, which are easy to confuse when you type a password by hand.
Should I change my passwords regularly?
Not on a fixed schedule. Change them when there is a breach or a reason to suspect one.