What makes a password strong
Two things: length and randomness. An 8-character password, even with symbols, can be guessed by a computer in hours; 16 random characters take centuries. Dictionary words, birth dates and "clever" substitutions like P@ssw0rd are the first things cracking programs try, so they add no real security.
The strength shown under the password is expressed in bits of entropy: every bit doubles the number of guesses needed. Above 60 bits you are safe from common attacks; above 80 from determined ones too.
Random password or passphrase?
A random password (e.g. x7#Kq2!mVp9$Lw4R) is ideal if a password manager remembers it for you. A passphrase (e.g. Falcon-Lantern-Honey-Rocket-42) is just as strong with 4-5 words but far easier to remember and type: perfect for the master password of your manager, your computer or your email.
Practical tips
- Use a different password for every service: if one site is breached, the others stay safe.
- Rely on a password manager (the one built into your browser is fine) instead of reusing the same password everywhere.
- Turn on two-step verification wherever possible: it is the most effective protection.
- Never send passwords by email or chat, and don't keep them in a text file.
Passwords are generated with the browser's cryptographic generator and are never transmitted or stored: when you close the page they are gone.
Frequently asked questions
How long should a password be?
At least 12 random characters; 16 or more for important accounts. With a passphrase, 4 words are enough and 5 are excellent.
Are the passwords generated here truly random?
Yes: they use crypto.getRandomValues, the browser's cryptographic generator, the same one used by password managers.
Is it safe to generate a password on a website?
Here it is, because generation happens only in your browser and nothing is sent to a server. You can check by going offline: the tool keeps working.