How to create a strong password
The strength of a password comes from being long and unpredictable. Every extra character multiplies the number of combinations an attacker has to try, so length is the single most effective lever you have. Use at least 12 characters for everyday accounts and 16 or more for email, banking and your password manager.
Mixing uppercase letters, lowercase letters, numbers and symbols enlarges the pool of possible characters and raises the entropy of every position. Randomness matters just as much: passwords chosen by people follow patterns — a name and a year, a word with @ in place of a, or a keyboard walk like qwerty. A generator built on the Web Crypto API has no such bias.
- Avoid dictionary words, names, birthdays and sequential characters.
- Don't rely on predictable substitutions such as P@ssw0rd.
- Never reuse a password across more than one site.
Password entropy and crack time
Entropy, measured in bits, expresses how hard a password is to guess. It is roughly the password length multiplied by the base‑2 logarithm of the character‑pool size. Each additional bit doubles the effort needed to break the password by brute force.
- Under 40 bits — weak; can fall in seconds to hours.
- Around 60 bits — acceptable for low‑value accounts.
- 75 to 100 bits — strong; impractical to brute force with today's hardware.
- Over 100 bits — excellent; suitable for master passwords and encryption keys.
The crack time shown by the checker assumes about 10 billion guesses per second, roughly what a modern GPU rig manages against a fast hash. Real figures vary with the hashing algorithm and the attacker's resources, so treat the number as a relative guide, not a guarantee.
How passwords get compromised
A strong, unique password defeats attacks that rely on guessing — but not every attack works that way:
- Brute force and mask attacks try every combination, or every combination that matches a known pattern.
- Dictionary attacks run through word lists and databases of passwords exposed in earlier breaches.
- Credential stuffing takes a login stolen from one site and tries it everywhere else — which is why reuse is so dangerous.
- Phishing tricks you into typing your password into a fake login page.
- Malware and keyloggers capture what you type, however strong the password is.
Length and randomness handle the first two. For the rest you need two‑factor authentication and a healthy suspicion of unexpected login prompts.
Best practices for managing passwords
- One unique password per account. A breach on one service then cannot unlock the others.
- Use a password manager such as Bitwarden, KeePassXC or 1Password. You memorise one strong master passphrase and it stores everything else.
- Turn on two‑factor authentication wherever it is offered, preferring an authenticator app or a hardware security key over SMS codes.
- Change a password when it matters — after a breach notice or a suspected compromise. Current guidance (NIST) advises against forced periodic rotation, which pushes people toward weaker, patterned passwords.
- Never share a password by email or chat, and never keep one in a plain‑text file or a spreadsheet.
Passphrases vs. random strings
A passphrase is several unrelated words picked at random, such as violin harbor nickel drift. With four to six truly random words it is very strong and far easier to type and remember than a random string. A random character password packs more entropy into each character and is the better choice when a manager fills it in for you and you never type it by hand.
A practical split: use a long passphrase for the one master password you must remember, and let this generator produce random strings for every individual account.
Is this generator private and secure?
Everything happens in your browser. The page has no back end: passwords are built locally in JavaScript and never sent over the network. The randomness comes from crypto.getRandomValues(), the browser's cryptographically secure generator, not the predictable Math.random().
There are no cookies, no analytics and no logging. You can open the page, disconnect from the internet, and it keeps working — and you can confirm nothing is transmitted by watching the Network tab in your browser's developer tools.
Further reading
- NIST SP 800-63B — Digital Identity Guidelines
- OWASP — Password Storage Cheat Sheet
- Have I Been Pwned — check for breached accounts
Generated a strong password? You need somewhere safe to keep it →
Related terms: Entropy · Brute force · Passphrase · Password manager · CSPRNG