How to Create a Strong Password (Free Generator)

A strong password is long, random and used for only one account. The simplest way to create one is a password generator, because people are poor at picking random characters: we choose words, dates and patterns that attackers try first.

Our free password generator builds a random password of 8 to 64 characters in your browser, using your operating system's secure random number generator. The password is never sent to our server. This guide explains what makes a password strong, what the NIST guidelines recommend, and how to store passwords once you have them.

What makes a password strong

Three things decide how hard a password is to crack:

1. Length. Every extra character multiplies the number of possible passwords an attacker has to try.
2. Randomness. A password made of real words, names or keyboard patterns falls to guessing tools long before its length suggests.
3. Uniqueness. When one site leaks your password, attackers try the same email and password on other sites. A password used once can't be reused against you.

Password entropy, explained

Security experts measure password strength in bits of entropy. For a password where each character is picked at random, the entropy is the length multiplied by log2 of the number of possible characters. Each extra bit doubles the number of guesses needed.

Characters used	Pool size	12 characters	16 characters	20 characters
Lowercase letters	26	56 bits	75 bits	94 bits
Lowercase and uppercase	52	68 bits	91 bits	114 bits
Letters and numbers	62	71 bits	95 bits	119 bits
Letters, numbers and our 25 symbols	87	77 bits	103 bits	129 bits

Compare the rows and columns. A 16-character password of letters and numbers (95 bits) is stronger than a 12-character password that uses every character type (77 bits). Length is the cheapest way to make a password stronger. These figures only hold for randomly generated passwords. A human-chosen password such as Sunshine1! has far less real entropy than its length suggests, because it follows a pattern attackers know.

Example

With the default settings (16 characters, symbols, numbers and mixed case all on), the generator produces passwords like q7#Lm2v!Rx9&tB4z, worth about 103 bits. Never use a password you have seen published anywhere, including this one.

What NIST SP 800-63B recommends

NIST Special Publication 800-63B is the US government's guideline for authentication, and much of the security industry follows it. Its current password rules focus on length and screening rather than complexity:

• Minimum length: at least 15 characters when the password is the only way to sign in, or at least 8 when it is combined with a second factor.
• Maximum length: systems should accept passwords of at least 64 characters.
• No composition rules: sites should not force mixtures such as "one uppercase, one number, one symbol".
• No scheduled changes: sites should not force password changes on a timer, only when there is evidence a password was compromised.
• Blocklists: new passwords should be checked against lists of breached, common and predictable passwords.
• Password managers: sites should allow pasting and password manager autofill.

Many sites still enforce composition rules, which is why the generator lets you turn character types on and off.

Passwords vs passphrases

A passphrase is a string of random words, such as five or six words picked by rolling dice against a word list. The Diceware method uses a list of 7,776 words, so each word adds about 12.9 bits; six words give about 77 bits. Passphrases are easier to type and remember, which makes them a good choice for the few passwords you must enter by hand, like your password manager's master password or your computer login. For everything stored in a password manager, a long random password is simpler. Our generator creates random character passwords, not passphrases.

How to use the Password Generator

1. Open the Password Generator. A password appears straight away under Generated password.
2. Drag the Length slider anywhere from 8 to 64 characters. The default is 16; use 16 or more for everyday accounts and 20 or more for email, banking and your password manager.
3. Turn Include symbols, Include numbers and Mixed case on or off to match the site's rules. Lowercase letters are always included, and the generator guarantees at least one character from every option you turn on.
4. Click Regenerate for a new password. Any change to the settings also creates a new one.
5. Click Copy and paste the password into your password manager and the sign-up form.

The symbols the generator uses are ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > ?. If a site rejects some of them, turn Include symbols off and add four or more characters of length to make up the difference.

Is it safe to use an online password generator?

It depends on where the password is made. Ours is created entirely in your browser with the Web Crypto API's crypto.getRandomValues(), which draws from the operating system's cryptographically secure random number generator. Characters are picked with rejection sampling, so every character is equally likely. Only your settings (length and character options) reach our server; the password itself is never transmitted, logged or written into the page.

Common password mistakes

• Reusing passwords. This is the most damaging habit, because one leak opens every account that shares the password.
• Predictable substitutions. Swaps like P@ssw0rd are among the first variations cracking tools try.
• Personal details. Names, birthdays, pets and sports teams are easy to find on social media.
• Storing passwords in plain text. A notes app, spreadsheet or sticky note is easy to copy or lose. Use a password manager, which encrypts your passwords and fills them in for you.
• Skipping two-factor authentication. Turn on an authenticator app, security key or passkey wherever it is offered. A second factor protects you even if a password leaks.

To set up Wi-Fi for guests, generate a password here, then share it with a scannable code from the QR code generator; our guide to making QR codes shows the exact Wi-Fi format. If you need random identifiers for a database rather than secrets, use the UUID generator instead, and see how UUIDs work.

Frequently asked questions

How long should a password be?

At least 15 characters if the password alone protects the account, following NIST SP 800-63B. For random generated passwords, 16 to 20 characters is a strong everyday choice, and longer is better for important accounts.

Is it safe to use an online password generator?

Use one that creates the password in your browser. Ours uses the operating system's secure random number generator through the Web Crypto API and never sends the password to the server.

How often should I change my password?

Only when there is a reason, such as a data breach or a sign that someone else has used your account. NIST advises against forced scheduled changes, which push people toward weaker, predictable passwords.

Do symbols make a password stronger?

Yes, but less than length does. Adding symbols to a 16-character random password raises it from about 95 to about 103 bits, while adding four more characters of letters and numbers raises it to about 119 bits.

Are passphrases better than random passwords?

A passphrase of six or more random words is strong and easier to remember and type. For passwords kept in a password manager, a long random character password is just as good and simpler to generate.

What is a strong password example?

A strong password looks like q7#Lm2v!Rx9&tB4z: 16 random characters with no words or patterns. Never use an example you have seen published; generate your own.