A strong password is long and genuinely random, and humans are bad at both. This generator uses the browser’s cryptographic random source, guarantees at least one character from each selected set, and shows the resulting entropy so you can judge strength as a number rather than a colour bar.
At least 16 random characters for important accounts. Length beats complexity: a 20-character lowercase password has far more entropy than an 8-character one with symbols scattered through it.
The generation itself is, since it uses crypto.getRandomValues and never leaves your device. The risk is your own machine — generate on a device you trust and store the result in a password manager.
Bits of randomness. Each bit doubles the guessing effort, so 80 bits is roughly a trillion times harder to brute force than 40. Anything above 75 bits is comfortable for most threat models.
Current guidance from NIST says no — forced rotation pushes people toward predictable variations. Change a password when there is a reason to: a breach, a shared device, or any suspicion of exposure.
All free tools · Blog · About · Contact