Step-by-step guide: How to Create a Strong Password (and Remember It)
How to use the Password Generator
- A password is generated as soon as the page opens. Select Generate new password for another.
- Move the length slider. For accounts, 16 characters or more is a strong choice; for secrets that never need typing, use 32 or more.
- Untick character types a site does not accept, and tick Exclude look-alike characters if you will have to read or type the password.
- Check the strength meter, which shows entropy in bits.
- Copy the password straight into your password manager. To create several at once, increase the number of passwords.
Example: how length and character types add up
| Characters used | Length | Entropy |
|---|---|---|
| Lower case only (26) | 8 | ≈ 37.6 bits |
| Upper, lower and digits (62) | 12 | ≈ 71.5 bits |
| All four types (88) | 16 | ≈ 103.4 bits |
| All four types (88) | 20 | ≈ 129.2 bits |
Each extra bit doubles the number of guesses needed. Length contributes more than complexity: adding four characters to a 16-character password adds about 26 bits.
Why generated passwords are stronger
People are bad at choosing random passwords. Human-made passwords follow predictable patterns — words with a capital first letter and a number at the end, keyboard walks, birthdays — and password-cracking tools try those patterns first. A password chosen uniformly at random from a large set of characters has no pattern to exploit, so an attacker’s only option is to try combinations, which is impractical at sufficient length.
The other essential is uniqueness: a different password for every account, so a breach at one site does not unlock others. A password manager makes long, unique passwords practical, because you do not have to remember them.
How the generator works
Random values come from crypto.getRandomValues(), the cryptographically secure random number generator built into your browser and seeded by your operating system. Characters are selected with rejection sampling so every character in the pool is exactly equally likely — a simple modulo would make some characters slightly more common.
When “at least one of each type” is ticked, one character from each selected set is placed and the rest are drawn from the full pool, then the whole password is shuffled with a cryptographically random Fisher–Yates shuffle. Entropy is calculated as length × log₂(pool size), a standard estimate for uniformly random passwords.
Limitations to keep in mind
- Some sites restrict which symbols or lengths are allowed. If a password is rejected, untick symbols or shorten it.
- The entropy figure assumes the password is used exactly as generated. Editing it by hand reduces its strength.
- A strong password does not protect against phishing. Turn on two-factor authentication where available.
How your data is handled
Passwords are generated in your browser and exist only on this page. They are never sent to a server, written to cookies or browser storage, or logged. Reloading or closing the page discards them.
Frequently asked questions
Is it safe to generate passwords on a website?
This generator runs entirely in your browser using the same secure random source as password managers, and does not transmit or store anything. You can check this with your browser’s developer tools. For the highest assurance, use the generator built into your password manager.
How long should my password be?
At least 12 characters for general accounts, and 16 or more for important ones such as email and banking. Length matters more than complexity.
Are symbols necessary?
Not if the password is long enough. A 20-character password of letters and numbers is far stronger than a 10-character one with symbols. Symbols help when length is limited.
What does entropy mean?
Entropy measures unpredictability in bits. A password with 80 bits of entropy would take on average 279 guesses to crack — far beyond any practical attack against a well-protected system.