How long should a strong password be?
At least 16 random characters, or a passphrase of 5 or more random words, gives well over 70 bits of entropy. Generate one here and store it in a password manager.
- Choose random characters or a passphrase.
- Set the length or number of words.
- Untick character sets a site does not allow.
- Check the strength line.
- Copy it straight into your password manager.
Examples
Passphrase
Result
Lake-Harp-Mint-Cube-Wolf-42
Frequently asked questions
Is this random enough?
Yes. It uses crypto.getRandomValues, the browser's cryptographically secure generator, with rejection sampling so every character is equally likely.
Is the password sent or saved?
No. It is created on your device, shown on screen, and gone when you leave the page.
What does bits of entropy mean?
It measures how many guesses an attacker would need: each extra bit doubles the work. 70 bits or more is strong for online accounts.
Passphrase or random characters?
Both can be strong. Passphrases are easier to type and remember; random characters pack more strength into fewer characters.