How do I make a strong password?
- 1Pick random characters, or a passphrase made of words.
- 2Set the length (or number of words) and the character types you need.
- 3Copy the password, or pick one of the five other options below it.
- 4Save it in a password manager — use a different password for every account.
How is password strength calculated?
- 01Entropy (bits) = length × log2(characters to choose from)
- 02Passphrase entropy = words × log2(words in the list)
- 03Possible passwords = 2^entropy
- 04Average time to crack = 2^entropy ÷ 2 ÷ guesses per second
Entropy measures how many guesses an attacker would need. Each random character chosen from 90 possible characters adds log2(90) ≈ 6.5 bits, so a 16-character password has about 104 bits — 2^104 possible passwords. A passphrase works the same way with words: each word picked at random from this tool's list of about 1,500 words adds about 10.6 bits, and adding a number adds a few more. When “at least one of each type” is on, passwords missing a type are thrown away and drawn again; the small loss of entropy this causes is counted exactly.
Every character is picked with your browser's cryptographically secure random generator (crypto.getRandomValues). Random numbers outside the last full block are rejected, so no character is more likely than another (no “modulo bias”). Time to crack assumes a fast offline attack of 10 billion guesses a second against a leaked password hash; on average an attacker finds the password after trying half of all possibilities. Under 50 bits is weak, 50–69 fair, 70–99 strong and 100 or more very strong.
Good to know
- Length beats complexity: a longer password adds far more strength than one extra symbol.
- Never reuse a password. If one site is breached, attackers try the same password everywhere.
- Use a password manager to store passwords, and turn on two-step verification for email and banking.
- Passphrases are easier to type on a phone or TV — use at least 6 or 7 random words.
- Turn on “avoid look-alikes” if you need to read a password out or type it from paper.
Password generator — common questions
How long should a password be?
NIST asks services to accept at least 15 characters for passwords used on their own. For important accounts, 16 or more random characters, or a passphrase of 7 or more random words, is a good choice.
Are these passwords safe to use?
Yes. They are generated on your device with the browser's cryptographically secure random number generator. Nothing is sent over the internet, saved or logged, and a new set is made each time.
Password or passphrase — which is better?
Both are strong when long enough and truly random. Random characters pack more strength per character; passphrases are longer but easier to remember and type.
Do I need symbols in every password?
Not necessarily. NIST guidance says services should not force composition rules; length and randomness matter most. Some sites still require a symbol, so the option is here.
What does entropy mean?
The number of bits of randomness. Each extra bit doubles the guesses an attacker needs, so 80 bits is about a million times harder to guess than 60 bits.
Is the crack time exact?
No, it's an estimate for an attacker who knows how the password was made and can try 10 billion guesses a second. Slow password hashes make real attacks much slower; online login limits make them slower still.
Sources
- NIST SP 800-63B — Digital Identity Guidelines: Authentication and Lifecycle Management
- MDN — Crypto.getRandomValues()
- EFF — Dice-generated passphrases
Formulas last reviewed: September 30, 2026 ·How we check our formulas