How to use the password generator
A password appears the moment the page loads. Drag the slider to set the length, tick the character types you want, and click ↻ for a new one. Copy puts it on your clipboard. Tick Avoid ambiguous if you’ll ever have to type the password by hand from a printout — it removes characters that look alike, such as l, 1, I, O and 0.
What makes a password strong
Strength is about how many possibilities an attacker must try. The generator’s entropy figure captures this:
entropy (bits) = length × log₂(number of possible characters)| Password | Pool | Entropy |
|---|---|---|
| 8 lowercase letters | 26 | 38 bits — cracked in minutes |
| 12 letters + digits | 62 | 71 bits — strong |
| 16 letters, digits, symbols | 90 | 104 bits — very strong |
| 20 lowercase letters | 26 | 94 bits — very strong |
Notice the last row: twenty plain letters beat twelve mixed characters. Length is the cheapest way to add security.
Why random beats clever
Patterns people think are clever — Summer2026!, P@ssw0rd, a pet’s name with a birth year — are the first things cracking tools try, because they’re built from lists of real leaked passwords and common substitutions. A random string has no pattern to exploit, so the only attack is brute force, and at 70+ bits brute force takes longer than the universe has existed.
Good password hygiene
- One password per account. Reuse is how a breach at one site becomes a takeover of your email.
- Use a manager. It generates, stores and fills passwords, and warns you about reused or breached ones.
- Turn on two-factor authentication for email, banking and social accounts. A passkey or authenticator app is better than SMS.
- Don’t rotate on a schedule. Modern guidance (NIST SP 800-63B) says change passwords only when there’s a reason, such as a breach.
- Check for breaches at haveibeenpwned.com. If an account was exposed, change that password and any that match it.
Passphrases as an alternative
If you must memorise a password — say, for your password manager itself — a passphrase of four to six random words (correct horse battery staple style) gives 50–75 bits and is far easier to remember than a random string. Use a dice-word list rather than words you choose yourself.
Frequently asked questions
Is it safe to use an online password generator?
This one runs entirely in your browser using the same secure random source as encryption software. The password is never transmitted. You can verify by generating one with your internet disconnected — it still works.
How long should a password be?
At least 12 characters for everyday accounts and 16 or more for email, banking and anything that protects other accounts. Length matters more than complexity — each extra character multiplies the number of guesses an attacker needs.
What do the "bits" mean?
Entropy in bits measures how many equally likely passwords the generator could have produced. Each bit doubles the count. 60 bits (about a quadrillion possibilities) is strong; 80+ is effectively uncrackable by brute force.
How am I supposed to remember these?
You're not. Use a password manager (Bitwarden, 1Password, KeePass, or the one built into your browser) to store them. You then only need to remember one strong master password.
Last updated August 26, 2026.