What makes a password strong?
Length matters most. Each extra character multiplies the number of possible passwords, so a 16-character password with mixed character types would take longer than the age of the universe to guess by brute force. Strength here is measured in bits of entropy: 60+ bits is strong, 80+ bits is excellent.
Good password habits
- Use a different password for every account.
- Store them in a password manager rather than reusing or writing them down.
- Turn on two-factor authentication wherever you can.
How length and character types add strength
Password strength is measured in bits of entropy. Every extra bit doubles the number of guesses an attacker needs.
| Length | Lowercase letters only | Letters and numbers | Letters, numbers and symbols |
|---|---|---|---|
| 8 characters | 38 bits | 48 bits | 52 bits |
| 12 characters | 56 bits | 71 bits | 78 bits |
| 16 characters | 75 bits | 95 bits | 104 bits |
| 20 characters | 94 bits | 119 bits | 130 bits |
Two things stand out. Length beats complexity: a 16-character password of only lowercase letters (75 bits) is stronger than an 8-character password using everything (52 bits). And these numbers only apply to random passwords — a password built from words, names or dates is far weaker than its length suggests, because attackers try those first.
How this generator works
Each character is chosen independently using your browser's cryptographic random number generator, the same source used to create encryption keys. The generator makes sure at least one character from every type you select is included, since many websites require it. The password is created on your device and is never transmitted or stored — you can even disconnect from the internet and it will still work.
Frequently asked questions
How long should my password be?
At least 12 characters for ordinary accounts, and 16 or more for important ones such as email, banking and your password manager. If a site allows it, longer is always better.
How am I supposed to remember a password like this?
You aren't. Random passwords are meant to be stored in a password manager, which fills them in for you. You then only need to remember one strong master password.
Should I change my passwords regularly?
Current guidance from security bodies such as NIST is that forced regular changes aren't necessary and tend to lead to weaker passwords. Change a password when there's a reason: a breach at that service, a suspicious login, or if you've shared or reused it.
Why avoid look-alike characters?
Characters such as capital I, lowercase l, the number 1, capital O and zero are easy to confuse when you have to read a password aloud or type it by hand. Excluding them makes that easier at the cost of a tiny reduction in strength.
Why isn't there a Download button on this page?
On purpose. A password saved in a plain file on your computer can be read by anyone or anything with access to it. Copy the password straight into your password manager instead.
Is a strong password enough?
It's the foundation, but turn on two-factor authentication wherever it's offered. Then even if a password is stolen in a breach, it can't be used on its own to get into your account.