What makes a password strong
- Length matters most. Adding characters does far more than swapping a letter for a symbol. Aim for 16 or more.
- Randomness: birthdays, pet names, keyboard patterns like “qwerty” and words with a number on the end are cracked quickly, however long they are.
- One per site: if one site leaks, a reused password puts every other account that uses it at risk.
Store your passwords in a password manager (such as iCloud Keychain, Google Password Manager, 1Password or Bitwarden) and turn on two-factor authentication for important accounts.
How strength is measured
Strength is shown as entropy in bits: with N possible characters and a length of L, it's L × log₂N. Using all four character types gives about 6.4 bits per character, so 16 characters is about 100 bits. Anything above 80 bits is out of reach of brute-force guessing with today's hardware.
FAQ
Is it safe to generate a password here?
Passwords are created with your browser's cryptographic random number generator (crypto.getRandomValues). They are never sent to a server or stored, and disappear when you reload the page.
What if a site doesn't allow symbols?
Turn symbols off and add four or five characters to get about the same strength.