How to Generate a Strong Password
- Set the length — 16 characters is a great default; use 20+ for banking and email.
- Keep all character sets on unless a site restricts them.
- Click Generate until you get one you like, then Copy it.
- Save it in a password manager immediately — the page does not remember it.
What Makes a Password Strong?
Password strength comes down to entropy: how many guesses an attacker would need, on average, to crack it. Entropy grows with two things — length and the size of the character pool:
| Password | Entropy | Time to crack (approx.) |
|---|---|---|
| 8 lowercase letters | ~38 bits | Minutes to hours |
| 8 mixed characters | ~52 bits | Days to months |
| 12 mixed characters | ~79 bits | Centuries |
| 16 mixed characters | ~105 bits | Effectively never |
The takeaway: length beats complexity. Going from 8 to 16 characters matters far more than adding a symbol or two. That is why the strength meter rewards length most.
Password Mistakes to Avoid
- Reusing passwords. The single most dangerous habit — one breached site exposes every account sharing the password.
- Predictable patterns like "Password123!" or seasonal words. Attackers try these first.
- Personal info — names, birthdays, pet names, and addresses are guessable and often public.
- Writing passwords on sticky notes or in unprotected notes apps. Use a proper password manager instead.
- Ignoring two-factor authentication. Even a strong password is safer paired with 2FA on important accounts.
The Passphrase Alternative
If you need a password you can actually memorize — say, for your password manager itself — consider a passphrase: 4–6 random words strung together, like "correct horse battery staple." Long passphrases are both strong and memorable. For everything else, let the generator make a random string and let the manager remember it.
Frequently Asked Questions
Is it safe to use an online password generator?
This one is: passwords are generated locally in your browser using your device's cryptographic random number generator, and nothing is transmitted or stored. As a rule, never use a password generator on a site you do not trust.
How long should my password be?
At least 12 characters for important accounts, and 16 or more is better. Length matters more than complexity — a 16-character password is vastly harder to crack than an 8-character one with symbols.
What does the strength meter measure?
It estimates entropy — roughly, how many guesses an attacker would need — based on password length and the size of the character pool. Higher entropy means a stronger password.
Should I use the same password on multiple sites?
No. Reusing passwords means one breached site exposes all your accounts. Use a unique password for every site and store them in a reputable password manager.
Are generated passwords stored anywhere?
No. Generated passwords exist only on your screen. Copy the one you want and save it in a password manager — if you close the page, it is gone.