What makes a password strong
Attackers don't guess passwords one at a time by hand. They use software that tries billions of combinations per second, starting with common passwords, dictionary words and patterns like "Summer2026!". A password resists this only if it's long and truly random.
Strength is measured in bits of entropy: the number of guesses needed, written as a power of two.
Every extra bit doubles the work for an attacker. Each extra character adds about 6 bits when you use all four character types, which is why length matters more than anything else.
How strong is strong enough?
| Entropy | Rating | Example length (all character types) |
|---|---|---|
| under 40 bits | Weak | 6 characters |
| 40–59 bits | Fair | 8–9 characters |
| 60–79 bits | Strong | 10–12 characters |
| 80+ bits | Very strong | 13+ characters |
For email, banking and your password manager's master password, aim for 80 bits or more.
How these passwords are made
The generator uses crypto.getRandomValues, the same secure random source browsers use for encryption, not the predictable Math.random. It always includes at least one character from each type you tick, so the password meets website rules, then shuffles the result so those characters aren't in predictable places. Nothing is sent over the internet or saved.
Good password habits
- Use a password manager (such as Bitwarden, 1Password, or the one built into your browser or phone). It remembers long random passwords so you don't have to.
- Never reuse passwords. When one site is breached, attackers try the same email and password everywhere else.
- Turn on two-factor authentication or passkeys wherever you can.
- Tick "avoid look-alikes" if you'll ever type the password by hand or read it aloud, so 0 and O or l and 1 can't be confused.
Frequently asked questions
How long should a password be?
At least 12 characters, and 16 or more for important accounts. Length adds more security than any other rule.
Is it safe to use an online password generator?
This one is: passwords are created in your browser with a secure random generator and are never sent or stored. Close the page after copying if you are on a shared computer.
What is a strong password example?
Something like k7#Qm2!vRz9@pL4x: 16 random characters from all four types. Don’t use any example you see published, including this one.
Should I use symbols in my password?
They help, because they increase the number of possible characters. Making the password longer helps even more.
How do I remember random passwords?
Use a password manager. It stores and fills them for you, so you only need to remember one strong master password.
Last updated October 2026 · More generators & random