What makes a password strong
Two things, and only two: length, and unpredictability. Everything else — the substituted characters, the exclamation mark on the end, the capital letter at the front — is decoration that attackers have accounted for since the early 2000s.
The generator above builds passwords from an 88-character set covering lowercase, uppercase, digits and symbols, using your browser's cryptographic random number generator. Each character therefore carries about 6.5 bits of entropy, which puts a 16-character password at roughly 103 bits. For context, a password with 80 bits of entropy is already far beyond brute-force reach with current hardware; 103 bits leaves a substantial margin against future improvement.
The passwords are generated on your device. Nothing is transmitted, logged or stored, and no password ever exists anywhere except in your browser tab. That is not a claim you can verify on most generator sites, and it is worth caring about — a password sent to a server for generation has, by definition, already been shared with someone.
Why "P@ssw0rd!" is not a strong password
Character substitution feels like it should help. It does not, because password cracking software applies exactly these substitutions automatically. A cracking rule set will try a→@, o→0, i→1, s→$, capitalise the first letter and append digits and punctuation, all as standard transformations of dictionary words.
The result is that a password built by decorating a real word is only marginally harder to crack than the word itself. What defeats cracking is the absence of any pattern to exploit — which is precisely what random generation provides and human invention does not.
How long should a password be?
| Length | Approximate entropy | Suitable for |
|---|---|---|
| 8 characters | ~52 bits | Minimum many sites accept; not adequate for anything valuable |
| 12 characters | ~78 bits | Reasonable for ordinary accounts |
| 16 characters | ~103 bits | A sensible default for everything |
| 24+ characters | ~155 bits | Password manager master password, encryption keys, root accounts |
Since a password manager does the typing, there is very little reason to choose a short one. Use 16 as your floor and go longer wherever the site permits it.
The rule that matters more than strength
Never reuse a password across sites.
This matters more than length because of how breaches actually play out. When a service is compromised, the stolen credentials are fed into automated login attempts against every other major service — a technique called credential stuffing. A perfectly strong password that you have used in two places offers no protection at all once one of those places is breached. A weak but unique password at least confines the damage to one account.
Unique passwords everywhere is impossible to do from memory, which is the entire argument for using a password manager. Generate, store, never memorise, never reuse.
Where to keep generated passwords
A password manager is the only practical answer once you have more than a handful of accounts. Bitwarden, 1Password and KeePassXC are all well regarded, and browsers now include competent built-in managers. You memorise exactly one long passphrase — the master password — and the manager handles everything else.
For that one master password, a passphrase of four or five random words is easier to type and remember than a random string, and remains strong provided the words are genuinely chosen at random rather than composed into a sentence you invented.
Turn on two-factor authentication
A strong password protects against guessing. It does not protect against a convincing phishing page, malware on your machine, or a breach at the service itself. Two-factor authentication does, because the stolen password alone is no longer sufficient.
Prefer an authenticator app or a hardware security key over SMS codes. SMS is better than nothing but is vulnerable to SIM-swapping, where an attacker persuades a mobile network to move your number to their device.
Frequently asked questions
Are these passwords really random?
They are generated using crypto.getRandomValues, the browser's cryptographically secure random source, rather than the ordinary Math.random function that many simple generators use. That distinction matters: Math.random is predictable if an attacker can observe enough output, and is not intended for security purposes.
Is my generated password sent over the internet?
No. Generation happens entirely in your browser. The password is never transmitted, saved or logged. It exists only in the page until you copy it, and disappears when you close the tab.
Should I change my passwords regularly?
Not on a schedule. Forced periodic expiry was long-standing advice, but it was found to make security worse, because people respond by making small predictable changes to an existing password. Modern guidance from both NIST and the UK's NCSC is to change a password when there is reason to believe it has been exposed, not on a calendar.
Does every generated password contain a symbol and a digit?
Not guaranteed. Each character is drawn independently from the full 88-character set, so a short password may occasionally lack a particular category. If a site demands one of each, generate again — at 16 characters the odds of a missing category are small.
How long would it take to crack a 16-character password?
Longer than is meaningful to state. Any honest answer depends on assumptions about hardware and how the site stored the password, and figures quoted in years are marketing rather than measurement. What is defensible: at roughly 103 bits of entropy, brute force is not the route an attacker would take. They would phish you, or breach the service, instead — which is why unique passwords and two-factor authentication matter more than adding characters.