How to Create a Strong Password
Almost everything people believe about password strength is wrong, and the rules most websites enforce actively make things worse. A password is strong when the set of possibilities an attacker must search through is enormous — not when it contains a capital letter and an exclamation mark. This tool generates passwords using your browser's cryptographic random number generator and reports strength as entropy in bits, which is the only measure that means anything.
Choose a style
Random for maximum strength per character, passphrase when you have to remember it, PIN for devices.
Set the length
Length matters far more than complexity. Twenty random characters beats twelve clever ones, every time.
Copy it into a manager
Click any password to copy. Generate several at once if you are setting up multiple accounts.
Why Entropy Is the Only Honest Measure
Consider P@ssw0rd!. It has an uppercase letter, a lowercase letter, a number and two symbols, so it satisfies essentially every corporate password policy ever written — and it is in the first few thousand guesses of any real cracking attempt, because attackers know the substitutions people make. Character-class rules measure the wrong thing entirely.
Entropy measures the actual search space. A password drawn randomly from a pool of 94 characters carries about 6.5 bits per character, so a 20-character one has roughly 130 bits — a number so large that no amount of computing power gets through it. Every extra character multiplies the difficulty; adding a symbol to a short password barely moves it. This is why length beats complexity, consistently and by an enormous margin.
The crack times shown here assume an attacker making a hundred billion guesses per second, which is realistic for an offline attack on a leaked database using modern hardware. They also assume the attacker knows nothing about the password beyond its length and character set — which is true for a randomly generated one, and badly false for anything a human invented.
Random or Passphrase?
Random, for anything in a password manager
You never type it, so readability does not matter. Twenty or more characters from the full set is as strong as it practically gets.
Passphrase, for the few you must remember
Your device login, your password manager's own master password. Four random words are genuinely strong and far easier to recall than random characters.
Four words is the floor, not the target
Each additional word from a two-hundred-word list adds around eight bits. Five or six words takes a passphrase into very strong territory.
Never reuse, whichever you choose
Reuse is the single biggest cause of account compromise. One leaked site becomes every account, which is exactly what a password manager exists to prevent.
Frequently Asked Questions
Is it safe to use an online password generator?
Only if it generates locally. This one uses your browser's cryptographic randomness and never transmits anything - a generator running on a server has, by definition, seen your password.
How long should a password be?
At least sixteen characters for anything that matters, and twenty or more for a password manager entry you never have to type. Length matters far more than complexity.
What is entropy and why does it matter?
It measures how large a space an attacker must search, in bits. Unlike character-class rules, it reflects actual strength - P@ssw0rd satisfies every rule and is trivially cracked.
Are passphrases really as strong as random passwords?
They can be, if the words are chosen randomly and there are enough of them. Four random words carry around thirty bits; six carry around forty-six, plus whatever else you add.
Is the randomness genuinely secure?
Yes. It uses the browser's cryptographic random number generator, with rejection sampling to avoid the subtle bias that a naive modulo introduces.
Should I avoid lookalike characters?
Only if you will read the password aloud or type it from paper. Removing them shrinks the character pool slightly, so keep them for anything stored in a manager.
Why does the site reject my generated password?
Some sites impose maximum lengths or ban certain symbols. Reduce the length or turn symbols off - and note that a site with a short maximum is telling you something worrying about how it stores passwords.
Should I change my passwords regularly?
Current guidance says no. Forced rotation makes people choose weaker, more predictable passwords. Change one when there is a reason to - a breach, or a suspicion.
Where should I store these?
In a password manager. Generating strong unique passwords only works if you are not trying to remember them, which is the entire point of a manager.
Can I generate several at once?
Yes, up to twenty. Useful when setting up multiple accounts - copy them all or download them as a text file.
Does the number at the end of a passphrase help?
A little - it adds around thirteen bits. Adding another word adds more, so if you want strength rather than a digit requirement, lengthen the phrase instead.
Is this password generator really free?
Completely free, with no limits, no signup and no premium wall. Everything runs in your browser.
Last updated: July 21, 2026 · FlipMyFormat Password Generator
Written and maintained by the FlipMyFormat team