How long should a password be?

At least 15 characters for a password used on its own, and at least 8 if it is one of two factors: that is the minimum in NIST’s current digital identity guidelines (SP 800-63B-4), which also tell sites to accept passwords of 64 characters or more and not to force mixes of character types. A random password of 16 to 20 characters from this generator is plenty; for a passphrase, use 5 or more random words.

Are passphrases more secure?

Not automatically: strength comes from how many equally likely choices there are, not from the format. A random 6-word passphrase from this generator has 66 bits (71 bits with the added number), less than a random 16-character password (103 bits), but it is much easier to type and remember. The words must be picked at random: a phrase you choose, such as a song lyric, is far weaker. Use passphrases where you have to type or remember, and random passwords everywhere else.

Is this generator safe to use?

Yes. The password is made in your browser with the Web Crypto API’s cryptographically secure random number generator (crypto.getRandomValues), using rejection sampling so every character is equally likely. It is never sent to a server, saved in your browser or included in analytics; once the page has loaded it works offline. As with any password tool, use it on a device you trust.

What is a strong password example?

Something like vT7#qL2!mZ9$kR4&wX8p: 20 random letters, numbers and symbols, about 128 bits. But never use a password you have seen published anywhere, including that one, because attackers add published examples to their lists. Generate your own and keep it in a password manager.

What does “bits of entropy” mean?

It counts how many equally likely passwords your settings can produce: n bits means 2 to the power n possibilities, and each extra bit doubles an attacker’s work. It measures the method, not one password, and assumes the attacker knows your settings, which is the safe assumption.

Should a password include symbols?

They help a little: going from letters and numbers (62 characters) to all four types (87) adds about 0.5 bits per character. Length helps more. If a site rejects symbols, turn them off and add 2 characters to make up the difference.

Password Generator: Create a Strong, Random Password

A strong password is long and random. This generator makes a 20-character password from letters, numbers and symbols (128 bits of entropy, beyond any guessing attack), or a passphrase of 6 random words that is easier to type and remember. It runs on your device with your browser’s cryptographic random number generator; nothing is sent or saved.

Updated 2026-09-28Runs in your browser: nothing you enter is uploadedHow this tool works

Password strength by length and character types

Entropy = length × log2(number of possible characters); every extra bit doubles the guesses. “All four types” is this generator’s 87 characters (26 + 26 + 10 + 25 symbols); requiring one of each type costs less than 1 bit. Ratings use the same scale as the strength checker.
Length	Numbers only (10)	Lowercase (26)	Upper and lowercase (52)	Letters and numbers (62)	All four types (87)
8 characters	26 bits · Weak	37 bits · Fair	45 bits · Fair	47 bits · Good	51 bits · Good
10 characters	33 bits · Fair	47 bits · Good	57 bits · Good	59 bits · Good	64 bits · Strong
12 characters	39 bits · Fair	56 bits · Good	68 bits · Strong	71 bits · Strong	77 bits · Strong
14 characters	46 bits · Good	65 bits · Strong	79 bits · Strong	83 bits · Strong	90 bits · Strong
16 characters	53 bits · Good	75 bits · Strong	91 bits · Strong	95 bits · Strong	103 bits · Strong
20 characters	66 bits · Strong	94 bits · Strong	114 bits · Strong	119 bits · Strong	128 bits · Strong
24 characters	79 bits · Strong	112 bits · Strong	136 bits · Strong	142 bits · Strong	154 bits · Strong
32 characters	106 bits · Strong	150 bits · Strong	182 bits · Strong	190 bits · Strong	206 bits · Strong
64 characters	212 bits · Strong	300 bits · Strong	364 bits · Strong	381 bits · Strong	412 bits · Strong

Passphrase strength by number of words

Each word is picked at random from this generator’s 2,048-word list (11 bits a word). “Add a number” puts one random digit after one random word. For comparison, dice-generated passphrases from a 7,776-word list get 12.9 bits a word. Times are to try every combination.
Words	This generator	With a number added	7,776-word list	Time at 10 billion guesses a second
4 words	44 bits · Fair	49 bits	51 bits	29 minutes
5 words	55 bits · Good	60 bits	64 bits	1 month
6 words	66 bits · Strong	71 bits	77 bits	234 years
7 words	77 bits · Strong	83 bits	90 bits	479 thousand years
8 words	88 bits · Strong	94 bits	103 bits	981 million years

How to create a strong password

Pick a password or a passphrase. Use a random password for accounts your password manager fills in for you, and a passphrase for the few you have to type or remember, such as the password manager itself or your computer login.
Set the length. Use 16 or more characters for a random password, or 5 or more words for a passphrase. The strength bar, bits and crack times update as you change the settings.
Match the site’s rules. If a site rejects symbols or caps the length, turn Symbols off or shorten the password, and add a couple of characters to make up for anything you turned off.
Copy it into your password manager. Press Copy, paste the password into your password manager or the sign-up form, then copy something else to clear your clipboard. Use each password for one account only.

Frequently asked questions

How long should a password be?: At least 15 characters for a password used on its own, and at least 8 if it is one of two factors: that is the minimum in NIST’s current digital identity guidelines (SP 800-63B-4), which also tell sites to accept passwords of 64 characters or more and not to force mixes of character types. A random password of 16 to 20 characters from this generator is plenty; for a passphrase, use 5 or more random words.
Are passphrases more secure?: Not automatically: strength comes from how many equally likely choices there are, not from the format. A random 6-word passphrase from this generator has 66 bits (71 bits with the added number), less than a random 16-character password (103 bits), but it is much easier to type and remember. The words must be picked at random: a phrase you choose, such as a song lyric, is far weaker. Use passphrases where you have to type or remember, and random passwords everywhere else.
Is this generator safe to use?: Yes. The password is made in your browser with the Web Crypto API’s cryptographically secure random number generator (crypto.getRandomValues), using rejection sampling so every character is equally likely. It is never sent to a server, saved in your browser or included in analytics; once the page has loaded it works offline. As with any password tool, use it on a device you trust.
What is a strong password example?: Something like vT7#qL2!mZ9$kR4&wX8p: 20 random letters, numbers and symbols, about 128 bits. But never use a password you have seen published anywhere, including that one, because attackers add published examples to their lists. Generate your own and keep it in a password manager.
What does “bits of entropy” mean?: It counts how many equally likely passwords your settings can produce: n bits means 2 to the power n possibilities, and each extra bit doubles an attacker’s work. It measures the method, not one password, and assumes the attacker knows your settings, which is the safe assumption.
Should a password include symbols?: They help a little: going from letters and numbers (62 characters) to all four types (87) adds about 0.5 bits per character. Length helps more. If a site rejects symbols, turn them off and add 2 characters to make up the difference.

How it works

Each character or word is chosen with crypto.getRandomValues. To avoid modulo bias, a random 32-bit number at or above the largest multiple of the alphabet size is thrown away and drawn again (rejection sampling), so every choice is equally likely. With “At least one of each chosen type” on, a whole password that is missing a type is thrown away and drawn again rather than patched, which keeps every qualifying password equally likely. Entropy is log2 of the number of passwords the settings can produce; for the one-of-each rule that number is counted exactly by inclusion–exclusion. Passphrases use a list of 2,048 common English words of 3 to 8 letters written for this site, so each word adds 11 bits; “Add a number” puts one random digit after one random word; capitals and the separator add nothing because they follow your settings. The strength rating uses the same guesses-based 0–4 scale as this site’s password strength checker, with guesses = 2^bits. Crack times are the time to try every combination at 100 guesses an hour (a login page that limits attempts), 10,000 a second (a stolen database hashed with a slow algorithm such as bcrypt) and 10 billion a second (a fast, unsalted hash on graphics cards). Nothing you generate is sent, stored or logged.

Sources

All tools Home & DIY calculators