Secure passwords: strength, entropy, and good habits
Your password is still a primary control against unauthorized access. This page explains how length, character variety, and randomness combine into entropy (bits), and why generated secrets beat human-chosen ones—without sending data off your device.
How password strength is judged
Password strength describes how well a secret resists guessing and brute-force search. Useful mental model: three pillars— length, complexity (which symbols are allowed), and unpredictability (no names, dates, or keyboard walks).
- Search space: each extra character multiplies the number of combinations an attacker might try.
- Complexity: mixing cases, digits, and symbols widens the alphabet attackers must assume.
- Randomness: machine-generated passwords avoid dictionary and rule-based attacks that exploit human habits.
Entropy in bits
Entropy (often shown in bits) summarizes unpredictability: higher bits mean vastly more possible passwords, on average, for a given generator model. The tool above estimates bits from your pool size and length.
Rough scale
- < 40 bits: very weak for secrets
- 60–80 bits: reasonable for many everyday accounts
- 80–100+ bits: strong
- 128+ bits: in line with cryptographic key material (when generation is truly random)
Very high-entropy passwords imply astronomical trial counts for naive brute force—still use MFA where it matters, and never reuse passwords across sites.
Practices worth keeping
Credentials
- Unique per site: one breach should not unlock every account via credential stuffing.
- Password manager: store long random secrets you cannot memorize; autofill beats retyping.
Accounts & networks
- MFA / 2FA: add a second factor for email, banking, and work—especially when SMS is not the only option.
- Sensitive sessions: avoid logging into high-risk accounts on untrusted or open networks without a VPN you trust.
Why this generator
Cryptographic randomness
Uses the browser’s secure RNG so characters are not biased by a simple PRNG.
Ambiguity control
Optional exclusion of I, l, 1, O, and 0 reduces typos when reading or retyping.
Client-side only
Generation runs in your browser; passwords are not uploaded to our servers.
FAQ
How long should a password be?
For most accounts, 16 characters or more is a solid minimum. High-value targets (email, banking, work) deserve at least 20–24 characters. Longer passwords increase entropy exponentially, making brute-force attacks impractical. This tool supports 4–64 characters; we recommend 16+ for general use and 20+ for sensitive accounts.
What makes a password strong?
Strength comes from length, character variety (uppercase, lowercase, numbers, symbols), and randomness. Predictable patterns (birthdays, pet names, keyboard walks) are weak even if long. A strong password is long, uses a mixed character set, and is generated randomly—like the output of this tool—so it resists both guessing and automated attacks.
Are random passwords better than ones I make up?
Yes. Human-chosen passwords tend to follow predictable patterns (words, dates, substitutions like @ for a), which attackers exploit with dictionary and rule-based attacks. A cryptographically random password has no pattern, so each character effectively multiplies the guess space. Use this generator and store the result in a password manager instead of inventing passwords yourself.
What does “entropy” or “bits” mean on this tool?
Entropy (shown in bits) measures how unpredictable your password is. Higher bits mean more possible combinations an attacker would need to try. Roughly: under 40 bits is very weak; 60–80 bits is adequate for many sites; 80–100+ bits is strong. The tool computes this from your character pool size and length so you can see the security level at a glance.
Is it safe to use this password generator for banking or work?
Yes. The generator runs entirely in your browser; nothing is sent to our servers. Passwords are built from your device’s cryptographic randomness (e.g. Web Crypto API). As long as you use a secure connection (HTTPS) and copy the password into a trusted password manager or form, it is safe to use for any account, including banking and work.
Why exclude ambiguous characters (I, l, 1, O, 0)?
These characters look alike on many screens and in some fonts, which can cause typos when you retype the password or read it from a backup. Excluding them reduces the chance of lockouts and support tickets. For maximum strength you can leave them in; for easier manual entry or sharing with non–password-manager users, turn on “Exclude ambiguous.”
How often should I change my passwords?
Change a password immediately if you suspect compromise or see a breach notice for that service. Otherwise, long random passwords do not need frequent rotation—many guidelines now recommend changing only when there’s a reason. Focus on using a unique, strong password per account and enabling 2FA where possible; that does more for security than forced periodic changes.