How the passwords are made
Each character is picked with your browser’s cryptographic random number generator, the same source used for encryption keys. The tool also avoids a subtle bias that simple generators have, so every allowed character is equally likely. When you tick several types, at least one character of each type is included, and their positions are random too.
The password is created on your device and is never sent anywhere or stored by this site.
What makes a password strong
Strength is measured in bits of entropy: the number of guesses an attacker would need, written as a power of two. Each extra bit doubles the work. Length helps far more than adding symbols.
| Password | About | Rating |
|---|---|---|
| 8 characters, all types | 52 bits | Fair |
| 12 characters, all types | 79 bits | Strong |
| 16 characters, all types | 105 bits | Very strong |
| 20 characters, letters and numbers | 119 bits | Very strong |
The ratings here are: under 50 bits weak, 50 to 69 fair, 70 to 99 strong, and 100 or more very strong. These numbers apply only to random passwords like the ones made here; a password you make up, such as a name and a year, is much weaker than its length suggests.
Good habits
- Use a different password for every account, so one leak cannot unlock the rest.
- Keep them in a password manager instead of a notes app or a spreadsheet.
- Turn on two-step verification for email, banking and social media.
- Avoid look-alikes only when someone will read or type the password, because it slightly shrinks the set of characters.
- Change a password straight away if a site tells you it was part of a data breach, and check your other accounts if you ever reused it.
If you need to remember a password without a manager, such as the one that unlocks your computer, a passphrase of four or five random words is easier to type and still strong. For everything else, let your password manager remember long random passwords like these.