Password Generator

What makes a password strong?

Strength comes from unpredictability, measured in bits of entropy. Every extra bit doubles the number of guesses an attacker needs. A password drawn at random from 87 possible characters gains about 6.4 bits per character, so length matters more than anything else: 16 random characters give roughly 103 bits, far beyond the reach of any known attack.

Human-chosen passwords are weak even when they look complex, because attackers try dictionary words, names, dates and common substitutions like “P@ssw0rd” first. A generator removes that pattern entirely — which is why you should never tweak a generated password to make it “more memorable”.

• *Offline attack at 100 billion guesses per second against a fast hash. Websites that store passwords properly (bcrypt, scrypt, Argon2) and limit login attempts make real-world attacks far slower.

Password or passphrase?

Use a random password for anything stored in a password manager — you never need to remember it, so make it long. Use a passphrase for the few secrets you must type from memory: your password manager’s master password, your computer login, or a Wi-Fi password guests will type. Six or seven random words are both strong and surprisingly easy to remember.

Passphrases here use the Electronic Frontier Foundation’s short word list of 1,296 common, easy-to-spell words, giving about 10.3 bits of entropy per word.

Password best practices

• Use a unique password for every account. When one site is breached, reused passwords are tried everywhere else within hours.
• Use a password manager to store them — Bitwarden, 1Password, KeePass, or the one built into your browser or phone.
• Turn on two-factor authentication (an authenticator app or passkey) for email, banking and social accounts.
• Don’t change strong passwords on a schedule. Change a password when there is a reason: a breach, a shared device, or a suspicion.
• Never send passwords by email or chat. Share them through your password manager’s sharing feature instead.

Is it safe to generate passwords online?

It is when the generator runs entirely in your browser, as this one does. The page uses your device’s cryptographic random number generator; the passwords are never transmitted, logged or saved, and they disappear when you close the tab. You can confirm it yourself: load the page, disconnect from the internet and keep generating.