Create a strong password with adjustable length, character sets and exclusions. Generated securely in your browser.
✓ Web Crypto randomness
↗ Runs in your browser
∞ Free, no account
Very strong103 bits · ≈ centuries at 10 billion guesses/sec
Generated on your device with the Web Crypto API. Nothing is sent or stored.
Space / Enter regenerates · Focus the password and press Ctrl/Cmd+C to copy
WHY USE IT
What makes a password strong?
A strong password is long, random and unique. Length and randomness decide how many guesses an attacker needs; uniqueness means one leaked password cannot unlock your other accounts. This generator gives you all three by default.
Longer passwords have exponentially more combinations
Every enabled character set adds entropy to each character
At least one character from each selected set is guaranteed
Live meter shows bits of entropy and estimated crack time
Presets for 12, 16, 20 and 32 characters
A unique password protects each account separately
HOW TO USE IT
Strong Password Generator in three steps
1
Pick 16 characters or more
Select the 16, 20 or 32 preset, or drag the slider for anything up to 128 characters.
2
Enable every character type
Keep uppercase, lowercase, numbers and symbols on for the largest pool and the highest entropy.
3
Check the meter and copy
Aim for “Very strong” (100+ bits), then copy the password into your password manager.
Strength is measured in bits
Password strength is usually expressed as entropy, measured in bits. Each bit doubles the number of guesses needed. A random password drawn from 94 printable characters gives about 6.5 bits per character, so 16 characters is roughly 104 bits.
For comparison, an attacker testing 10 billion guesses per second would need around 10 minutes for 52 bits (8 random characters) but far longer than the age of the universe for 104 bits.
Common myths about strong passwords
Many popular rules make passwords harder to remember without making them much harder to crack.
Swapping letters for look-alike symbols (p@ssw0rd) does not help; crackers try those substitutions automatically.
Changing passwords on a schedule is no longer recommended by NIST unless there is a sign of compromise.
A long, unpredictable password beats a short one with “complex” characters.
A strong password reused on several sites is only as safe as the weakest site.
Strong passwords need good habits
Even the strongest password can be phished or leaked in a breach. Combine it with two-factor authentication, prefer passkeys where sites support them, and check services like Have I Been Pwned to find out whether an old account has been exposed.
MORE FREE TOOLS
Pick the right generator for the job
Use a unique secret for every account and store it in a reputable password manager.
Use at least 16 random characters when a password manager stores it, and 20 or more for email, banking and your most important accounts.
Should I include symbols?
Yes, when the site allows them. Symbols enlarge the character pool and add entropy to every character.
How many bits of entropy is strong enough?
Around 80 bits resists offline attacks for decades. 100 bits or more is a comfortable margin for high-value accounts.
Is a 12-character password strong?
A truly random 12-character password with all character types is about 78 bits, which is good. 16 characters is a better default because it costs you nothing when a password manager stores it.
Does this tool guarantee each character type is included?
Yes. The generator always includes at least one character from every set you enable, then fills the rest at random and shuffles the result.
Are my passwords stored anywhere?
No. Generation happens entirely in your browser and nothing is sent to or saved on our servers.
Ready for a password you can trust?
It takes one click, and it never leaves your browser.
