What makes a password strong?
A strong password is one an attacker cannot guess or work out by trying combinations. Two things matter most: length and randomness. Every extra character multiplies the number of possible passwords, and true randomness means there is no pattern, word or date for an attacker to exploit. “Summer2026!” looks complex but follows a predictable pattern that cracking tools try early; a random 16-character string does not.
The most important rule is to use a different password for every account. When one website is breached, attackers try the leaked email and password on other sites. A password manager makes unique passwords practical, because you only need to remember one master password.
How to use the password generator
- Choose a length. 16 characters or more is recommended for important accounts.
- Choose which characters to include. Tick avoid look-alikes if you will ever need to read or type the password by hand.
- Copy the password, or press the refresh button for a new one. Set how many to generate a batch.
- Save it straight into your password manager.
How strength is measured
For a truly random password, strength is measured in bits of entropy:
Entropy (bits) = Length × log₂(Number of possible characters)
With all four character types there are 87 possible characters, so each one adds about 6.4 bits, and a 16-character password has about 103 bits. The crack-time estimate assumes an attacker with powerful hardware trying 10 billion guesses a second against a stolen password database, and the time to search half of all possibilities. Above about 80 bits is out of reach for any realistic attacker.
Each password is built with crypto.getRandomValues and unbiased rejection sampling, and is guaranteed to contain at least one character from every type you selected. Nothing is sent over the network or stored.
Examples by length
| Characters | Length | Entropy | Rating |
|---|---|---|---|
| Lowercase only | 8 | 38 bits | Weak |
| All types | 10 | 64 bits | Strong |
| All types | 16 | 103 bits | Very strong |
| All types | 24 | 155 bits | Very strong |
More worked examples
Length matters: a 12-character password using all character types has about 77 bits of entropy; at 16 characters it has about 103 bits, far beyond any realistic attack.
Common mistakes to avoid
- Reusing passwords. One breach then unlocks every account; use a unique password for each.
- Short complex passwords. Length adds far more strength than symbols.
- Storing passwords in plain notes. Use a password manager. For IDs rather than secrets, use the UUID generator.
Sources and methodology
The calculations on this page follow these published standards and references. The code is covered by automated tests against known values.