Build a password that would take centuries to crack.
Pick a length, choose which character types to mix in, and generate a strong, random password right in your browser. Nothing is sent anywhere. See the entropy and estimated crack time as you tune it.
Your settings
What this means
Strength at different lengths
| Length | Combinations | Entropy | Strength |
|---|
How password strength works
Why Strong Passwords Matter
Weak passwords are the leading cause of data breaches. A 6-character lowercase password can be cracked in seconds. A 16-character password with mixed character types would take billions of years to brute-force with current technology.
What Makes a Password Strong
Strong passwords are at least 12 characters long, use a mix of uppercase, lowercase, numbers, and symbols, avoid dictionary words and personal information, and are unique for each account. Length is the most important factor.
Password Strength Levels
Weak: under 8 characters or single character type. Fair: 8-11 characters with 2 types. Good: 12-15 characters with 3 types. Strong: 16+ characters with all 4 types. Each additional character exponentially increases cracking difficulty.
Best Practices for Password Management
Use a unique password for every account. Store passwords in a reputable password manager. Enable two-factor authentication wherever available. Never share passwords via email or text. Change passwords immediately if a breach is reported.
Common questions
How long should my password be?
At minimum 12 characters, but 16 or more is recommended. Each additional character multiplies the number of possible combinations. A 16-character password with all character types has about 3.4 x 10^31 possible combinations.
Are random passwords better than passphrases?
Both can be strong. A random 16-character password is very secure. A passphrase of 4-5 random words (like "correct-horse-battery-staple") is easier to remember and also very secure if the words are truly random.
How often should I change my passwords?
NIST guidelines no longer recommend routine password changes. Change passwords only when there is reason to believe they have been compromised, such as after a data breach notification. Focus on using unique, strong passwords instead.
Is this password generator secure?
The password is generated entirely in your browser using JavaScript. No passwords are sent to any server or stored anywhere. Each time you calculate, a new random password is generated using Math.random().
Passwords are generated entirely in your browser and never sent or stored anywhere. Crack-time estimates assume fast offline guessing and are rough guides, not guarantees.