Strong password generator

What makes a password strong?

Length matters more than anything else. Every extra character multiplies the number of possible combinations an attacker has to try. Character variety helps too, but a long random password beats a short "complex" one. The table shows the strength, measured in bits of entropy, of passwords made by this generator:

Around 80 bits or more is out of reach of brute-force attacks with today's hardware. That's why we recommend at least 16 characters for important accounts.

How the generator works

Passwords are created in your browser with the Web Crypto API (crypto.getRandomValues), the same cryptographically secure randomness source used by security software. It is not Math.random(), and nothing you generate is sent to a server or stored anywhere.

Good password habits

• One password per account. If one site is breached, reused passwords let attackers into all your other accounts.
• Use a password manager to store them, so you only have to remember one strong master password.
• Turn on two-factor authentication for email, banking and social media. It protects you even if a password leaks.
• Change a password when there is a reason, such as a data breach, not on a fixed schedule. Current NIST guidance no longer recommends forced periodic changes.
• Passphrases are fine too: four or more random words (not a famous quote) are easy to type and hard to guess.

More tips in our guide to creating strong passwords.

Passwords to avoid

Attackers don't guess one character at a time: they start with lists of leaked passwords and common patterns. These are cracked in seconds, however "complex" they look:

• Common words and sequences: password, qwerty, 123456, iloveyou.
• A word with predictable changes: P@ssw0rd!, Summer2026!. Swapping letters for symbols is one of the first things cracking tools try.
• Personal details: your name, your pet's name, a football team, a birthday or a postcode.
• Any password you have used on another site, even with a number added at the end.

Password or passphrase?

A random password such as q7#Lm2v!Xr9pT4zA is the strongest option per character, and it is ideal when a password manager types it for you. A passphrase of four or more random words (for example violin-harbour-copper-meadow) is longer but easier to remember and to type on a phone or a TV. Both are safe if the words or characters are chosen at random. Use passphrases for the few passwords you must remember, such as your password manager or your computer login, and random passwords for everything else.

If a site won't accept your password

Some sites limit the length or the symbols you can use. Untick Symbols and make the password longer instead: a 20-character password with letters and numbers is stronger than a 12-character one with symbols (see the table above). If there is a maximum length, use the longest one allowed.

What to do if a password has leaked

1. Check whether your email appears in known breaches at Have I Been Pwned.
2. Change the password on the affected site, and on any other site where you used the same one.
3. Turn on two-factor authentication on that account.
4. Watch out for emails or messages that mention the breach: attackers often follow a leak with phishing.