What actually makes a password strong
Password strength is entropy: the number of guesses an attacker needs, on average, to hit yours. Length drives it harder than anything — each added character multiplies the search space by the size of your character set. A 20-character lowercase password beats an 8-character symbol soup by orders of magnitude.
Humans are terrible random generators: we pick words, keyboard walks and the same dozen substitutions, and cracking dictionaries know them all. Real randomness needs a cryptographic source — crypto.getRandomValues, not Math.random — and a generator that never sees or stores what it makes.
Open the free Strong Password Generator — no signup, runs entirely in your browser.
How to use it
- Set the length — 16 characters minimum for anything you care about; more is free.
- Toggle character sets: lowercase, uppercase, digits, symbols; exclude lookalikes if needed.
- Generate, check the entropy meter, and copy straight into your password manager.
Why this one
- Cryptographically secure randomness via crypto.getRandomValues with bias-free selection.
- Passwords from 8 to 128 characters, up to 20 at a time.
- Ambiguous-character filter drops I, l, 1, O and 0 for read-aloud cases.
- Live entropy estimate in bits, so strength is a number, not a vibe.
Frequently asked questions
How long should a password be?
For anything generated and stored in a password manager: 16-20 characters minimum, 24+ for high-value accounts. If a human has to memorize it, a long passphrase of random words beats a short complex string.
Are the generated passwords stored or sent anywhere?
No. Generation happens entirely in your browser using the Web Crypto API. Nothing is transmitted, logged or stored — close the tab and the password exists only where you pasted it.
What is password entropy?
A measure of unpredictability in bits: log2 of the number of possible passwords. 80+ bits is strong against online and offline attacks; below 50 bits, a motivated attacker holding the hash can brute-force it.