What Makes a Password Strong?
Two things: length and randomness. Every extra character multiplies the number of possible passwords an attacker must try, and true randomness ensures there’s no pattern to exploit. A 16-character random password from a full character set has more possible combinations than there are atoms in a human body — no amount of guessing hardware gets through that.
What doesn’t make a password strong: substituting @ for a, appending 123!, or using a memorable phrase from a song. Attackers’ tools try all of those patterns first. The uncomfortable truth is that a password a human can invent is a password software can guess — which is why generated passwords plus a password manager beat clever memorization every time.
What Does This Tool Do?
This tool generates random passwords locally in your browser using the Web Crypto API — the same cryptographically secure random source used for encryption keys. You control the length (4–128 characters) and which character sets to include: lowercase, uppercase, digits, and symbols. Every selected set is guaranteed to appear at least once, satisfying the composition rules most sites enforce.
The strength meter shows the password’s entropy in bits — the honest mathematical measure of how hard it is to guess.
How to Use This Tool
- Set the desired length and toggle the character sets you need.
- A password is generated instantly — every option change regenerates it.
- Click Regenerate for a new password with the same settings.
- Copy it with the copy button and store it in a password manager.
How Long Should a Password Be?
Entropy grows with both length and pool size. Approximate strength for full-charset (~90 characters) passwords:
| Length | Entropy | Verdict |
|---|---|---|
| 8 chars | ~52 bits | Crackable by determined attackers — avoid |
| 12 chars | ~78 bits | Good for most accounts |
| 16 chars | ~104 bits | Strong — recommended default |
| 20 chars | ~130 bits | Beyond practical attack for the foreseeable future |
| 24+ chars | 155+ bits | For the keys to the kingdom (password manager, email) |
Since a password manager types it for you, the traditional cost of long passwords — typing them — mostly disappears. Default to 16+ and go longer for accounts that reset everything else (your email, your password manager).
The “Exclude Ambiguous” Option
Characters like I, l, 1, O, 0, and o are nearly indistinguishable in many fonts. That doesn’t matter when passwords are copy-pasted, but it matters a lot when one must be read aloud, typed from paper, or entered on a TV keyboard. The Exclude ambiguous toggle removes them, trading a little entropy for a lot of practical usability.
Frequently Asked Questions
Is it safe to generate passwords in a browser?
Yes — this generator runs entirely on your device using crypto.getRandomValues(), the browser’s cryptographically secure random source. The password is never transmitted, logged, or stored; it exists only on your screen and clipboard. You can even load the page, disconnect from the internet, and generate offline.
What do the entropy bits mean?
Entropy measures the size of the search space: N bits means 2ᴺ equally likely possibilities. Each added bit doubles an attacker’s work. As a rule of thumb, 40 bits is weak, 60 is fair, 80+ is strong, and 100+ is beyond any practical brute-force attack.
Should I use a different password for every site?
Yes — it’s the single most important password habit. Password reuse is how one leaked database becomes ten compromised accounts (“credential stuffing”). A password manager makes unique passwords effortless: you memorize one strong master password and generate the rest.
What about passphrases like "correct horse battery staple"?
Random-word passphrases are a legitimate alternative — easier to memorize and type, at the cost of length. Four truly random common words give ~44 bits; six give ~66. They shine for the few passwords you must type from memory (laptop login, master password). For everything stored in a manager, random character passwords are denser.
Why does my bank reject some generated passwords?
Some sites cap length or forbid certain symbols. Lower the length or turn off Symbols and regenerate — a 16-character password without symbols is still far stronger than a short “complex” one.
Should I change my passwords regularly?
Current guidance (including NIST’s) says no — forced rotation produces predictable patterns (Password2025! → Password2026!). Change a password when there’s a reason: a breach notification, a shared account, or suspicion of compromise. Otherwise, long + unique + stored in a manager beats frequent rotation.