What makes a password strong
Strength comes from two things: how many characters are in the password, and how many different characters it could have drawn from at each position. Length matters more than complexity — a 20-character password of lowercase letters alone can beat an 8-character password stuffed with symbols. This generator lets you push both, but if you can only lengthen one thing, lengthen the password.
The strength meter estimates entropy in bits from your chosen length and character set. Treat anything under 40 bits as weak, 40–60 as fair, 60–80 as strong, and above 80 as very strong for nearly any purpose.
Using it well
- Use a different password for every account. A password manager makes this practical — you only need to remember the one master password.
- 16 characters with all four character types is a sensible default for most sites.
- Turn on Exclude look-alike characters only if you expect to type the password by hand.
- Turn on two-factor authentication wherever it's offered — a strong password helps, but 2FA stops most account takeovers even if a password leaks.
Common questions
Is this actually random, or predictable?
It uses your browser's cryptographically secure random number generator (Web Crypto API), the same class of randomness used for encryption keys. That is different from and stronger than the plain Math.random function many simple generators use.
Is my generated password sent anywhere or logged?
No. The password is generated and shown entirely in your browser. Nothing is transmitted, stored or logged anywhere.
What does the strength meter measure?
It estimates entropy in bits from the password's length and the character types it draws from. Above roughly 80 bits is considered very strong for most purposes; below 40 bits is weak enough to be worth lengthening.
Should I exclude similar-looking characters?
Turn that on if you might need to type the password by hand or read it off a screen, since it removes easily confused characters like l, 1, I, O and 0. Leave it off for maximum strength when you'll copy and paste instead.
How long should my password be?
16 characters with all four character types is a solid default for most accounts. Use longer for anything protecting financial or highly sensitive access, and always pair it with a password manager and two-factor authentication where available.