What makes a strong password
- Length matters most — aim for at least 16 characters.
- Mix uppercase, lowercase, numbers and symbols.
- Use a unique password for every account.
- Store them in a password manager rather than memorising.
This generator runs entirely in your browser using the cryptographically secure random generator built into your device. Your password is never sent over the internet or stored anywhere.
How to use it
Set the length, choose which character types to include, and a new password is generated instantly. Click Regenerate for another, then Copy.
Why length matters more than complexity rules
A 20-character password using only lowercase letters is harder to crack by brute force than a 10-character password with every character type mixed in. Each additional character multiplies the number of possible combinations, while adding character types only multiplies it by a small, fixed factor. If a site limits length but not complexity, length is still the setting worth maximizing first.
What to avoid
Skip anything based on personal information — birthdays, pet names, addresses — even with numbers substituted for letters, since those substitutions are the first thing cracking tools try. Reusing a password across accounts means one breach exposes every account that shares it, regardless of how strong the password itself is.
How a breach on one site turns into many
The mechanism is called credential stuffing: if a password gets exposed in a breach on a low-security site and you've reused it elsewhere, attackers don't need to crack anything — they just try that same email-and-password pair automatically against banks, email providers and other major services. A single reused password is only as safe as the weakest site you've ever used it on, which is the real argument for a unique, generated password per account rather than a strong-but-memorable one repeated everywhere.
Passphrases vs. generated passwords
A passphrase — several random, unrelated words strung together — can be just as strong as a generated password, since length is what drives the real security either way. The catch is the word "random": a phrase built from a famous quote, a song lyric, or a common saying is not actually random, and is exactly the kind of pattern cracking tools are built to try first. Where a passphrase can matter is memorability — for the handful of passwords you genuinely need to type from memory (a device passcode, a password manager's own master password), a long, truly random passphrase is easier to recall than a random string of symbols. For everything else, a fully random generated password like the one above is simpler, since a password manager remembers it for you either way — you only need to actually recall the small handful of passwords that unlock the manager itself.
What government guidance says
The length-first, unique-password approach isn't just industry folklore — CISA (the U.S. Cybersecurity and Infrastructure Security Agency) recommends the same fundamentals: long, randomly generated passwords, a unique one per account, and a password manager to store them. If a passphrase is more your style, CISA's own guidance suggests stringing together 5-7 unrelated words rather than a memorable phrase or quote — the "unrelated" part is what keeps it resistant to guessing.