How password strength is estimated
Strength here is measured in bits of entropy — a standard way to express how many random guesses an attacker would need on average to find your exact password. The formula is:
A larger character set (more allowed symbols) and a longer password both increase entropy, but length has a bigger multiplying effect over the same number of added characters.
Reference: character set sizes
| Character types enabled | Set size |
|---|---|
| Lowercase only | 26 |
| Lowercase + uppercase | 52 |
| + Numbers | 62 |
| + Symbols | ~94 |
Step-by-step: choosing settings for different accounts
- For anything sensitive — email, banking, a password manager's own master password — use the maximum length you're comfortable storing (16 or more) with all character types enabled.
- For accounts with strict, unusual rules (some older systems reject certain symbols), disable symbols and rely on length plus letters and numbers instead.
- Always store the result in a password manager rather than a plain text file or note app, since a generated password isn't meant to be memorized.
- Generate a fresh password per account — reusing even a strong password across sites means one breach can expose all of them.
Common password mistakes this tool avoids
- Predictable substitutions — swapping "a" for "@" or "e" for "3" adds very little real protection, since these substitutions are well known and checked first by cracking tools. A randomly generated password doesn't rely on this weak pattern at all.
- Reused passwords — the single biggest real-world risk isn't a weak password, it's the same password used across multiple accounts, since one leaked site exposes every other account using it. A password manager that generates and stores a unique password per site removes this risk almost entirely and is generally considered better practice than memorizing several passwords, or worse, reusing one everywhere.
- Personal information — names, birthdays, and pet names are among the first guesses in a targeted attack. A randomly generated password contains none of that.
Two-factor authentication adds a separate layer of protection beyond the password itself, and is worth enabling anywhere it's offered, especially on email and financial accounts — a strong password reduces the odds of a successful guess, while two-factor authentication limits the damage even if a password is compromised through some other means, such as a data breach on the site's end rather than a weakness in the password itself.
Why length matters more than complexity
A common misconception is that a short password with symbols ("P@ss1!") is safer than a longer one without them. In practice, length is the dominant factor in how long a password takes to guess through brute force, because every extra character multiplies the number of possible combinations an attacker has to try. A 16-character password using only letters and numbers is typically far harder to crack than an 8-character password stuffed with symbols. This tool defaults to a longer length for that reason — if you have to shorten it for a site's character limit, try to keep the length as high as that limit allows before trimming character variety.
Frequently asked questions
It's safe specifically because this tool never sends anything anywhere — the random password is generated entirely inside your browser using the Web Crypto API (the same cryptographically secure random number source browsers use for security-sensitive operations), and it's never transmitted, logged, or stored. As a general rule, avoid password generators that show ads mixed into the result area or ask you to "copy from server" — this one does neither.
Each additional character multiplies the number of possible combinations, while adding a new character type (like symbols) only multiplies by a smaller factor. A 16-character password using just letters and numbers is typically far harder to guess than an 8-character password stuffed with symbols — length is the dominant factor in resisting brute-force attempts.
Yes — reusing a password means a breach on one site can compromise every account using the same password. A password manager (built into most browsers, or a dedicated app) makes using a unique generated password for every account practical without having to memorize them all.
It estimates entropy — a rough measure of how many attempts a brute-force guess would need on average, based on the password's length and which character sets you enabled. It's an estimate of randomness, not a guarantee against every possible attack (like phishing, which no password strength can prevent).
Fully random passwords are intentionally hard to memorize — that's part of what makes them secure. For accounts you need to type from memory often, consider a long passphrase of random unrelated words instead; for everything else, a password manager is the more practical option.