What makes a password strong?
Length matters most. Every extra character multiplies the number of guesses an attacker needs, so a random 16-character password with letters, numbers and symbols would take longer than the age of the universe to guess, while an 8-character one can fall in hours. Randomness matters too: real words, names and dates are tried first.
How to use the password generator
- Set the length. 16 characters or more is a good default; use 20+ for email, banking and password-manager master passwords.
- Choose the characters. Keep all four kinds unless a site refuses symbols. Leave out look-alikes if you will ever read the password aloud or type it from paper.
- Copy a password and save it in your password manager straight away.
How strong is strong?
- Strength is shown in bits of entropy: each bit doubles the number of possible passwords.
- Under 40 bits is weak, 60–80 bits is good for most accounts, and 80 bits or more is strong.
- Every password includes at least one character of each kind you tick, and the characters are picked with your browser’s cryptographic random number generator.
Good habits
- Use a different password for every account, so one leak does not unlock the rest.
- Let a password manager remember them; you only need to remember one strong master password.
- Turn on two-step verification wherever it is offered.
Frequently asked questions
Is it safe to make a password on a website?
Here, yes: passwords are created by JavaScript in your browser and are never sent to a server or stored. You can even disconnect from the internet after the page loads and it keeps working.
How long should my password be?
At least 12 characters, and 16 or more for important accounts. Longer is always stronger.
Why leave out similar-looking characters?
Characters such as I, l and 1 or O and 0 are easy to confuse when you read a password from paper or a screen. Leaving them out makes it slightly weaker, so add a character or two to compensate.