How to make a strong password
- Set the length with the slider. 16 or more is a good default.
- Choose upper case, lower case, numbers and symbols, and turn on avoid look-alike characters if you will type it by hand.
- Check the strength reading, and make several at once if you need more than one.
- Copy the password straight into your password manager or the site.
How the passwords are made
Passwords are generated in your browser with crypto.getRandomValues, the cryptographic random number generator built into modern browsers. It is designed to be unpredictable, unlike the ordinary random function used for games. The password is not sent to a server and is not saved, so once you close the page it exists only where you pasted it.
The avoid look-alike option leaves out characters that are easy to confuse, such as 0 and O, or 1, l and I. Use it when someone will read the password off paper or type it on a TV remote.
What the strength in bits means
Strength is shown as bits of entropy: the number of characters multiplied by how much each random character adds. Each extra bit doubles the number of guesses an attacker would need. A 12 character password using only lower case letters has about 56 bits. A 16 character password drawing from all 94 standard keyboard characters has about 105 bits.
That figure is only meaningful for random passwords like these. A password you made up yourself, such as a word with a number on the end, is far weaker than its length suggests, because attackers try common patterns first.
Habits that matter more than the password
- Use a different password for every site, so one leak does not open your other accounts
- Keep them in a password manager, so you only need to remember one strong master password
- Prefer length over complexity: adding characters helps more than adding symbols
- Turn on two-step verification for email, banking and anything else important
For a password you must remember, the National Cyber Security Centre recommends three random words, such as a phrase made of three unrelated words. It is long, memorable and much harder to guess than a short complex password.
Questions people ask
Is it safe to use an online password generator?
This one generates the password on your device using the browser's cryptographic generator, and nothing is sent or stored. You can disconnect from the internet after the page loads and it still works.
How long should my password be?
For a random password kept in a password manager, 16 characters or more is a sensible choice. Where a site has a maximum, use the longest it allows.
Do I need symbols in my password?
They add some strength, but length adds more. Some sites reject certain symbols, so turn them off if a site will not accept the password and add a few characters instead.
What is a good entropy score?
Around 80 bits or more is strong for most accounts. Below about 50 bits a random password can be guessed far more easily.
Can I make lots of passwords at once?
Yes. Generate several in one go, which helps when setting up a batch of accounts or Wi-Fi networks.