How to Generate a Strong Password Online (Free, Secure)

What makes a password "strong"?

Password strength is measured in entropy — roughly, how many guesses an attacker would need to try before landing on yours. Length dominates every other factor: a 20-character random string beats a 10-character "clever" password every time. A modern GPU can try billions of 8-character passwords per second. Sixteen characters pushed to the same hardware would take over a century.

How the generator works

The password generator uses the browser's crypto.getRandomValues() API — the same cryptographic randomness source used for TLS key generation. That's very different from Math.random(), which is predictable and unsuitable for security. You configure length and which character classes to include (uppercase, lowercase, digits, symbols) and the generator samples uniformly from that alphabet.

Recommended lengths by account type

• 16 characters — social media, forums, non-financial accounts. Uncrackable for most real-world attackers.
• 20 characters — email, banking, cloud storage, work accounts. The account types where compromise cascades.
• 24+ characters — password manager master passwords, admin panels, production servers, crypto wallets.
• 32 characters — treat as a cryptographic secret (API keys, signing keys).

Symbols: include or skip?

Include them when the site accepts them. Sites with dumb validation (no ! or @) force you to skip symbols — just compensate with 4 more characters of length. Entropy-wise, four extra lowercase letters ≈ one symbol.

Passphrases vs random strings

A six-word passphrase like correct-horse-battery-staple-granite-moon (chosen randomly from a long wordlist) has roughly the same entropy as a 12-character random password — but is dramatically easier to type when you can't paste. Use passphrases for things you type frequently; use random strings for things your password manager fills in.

Never reuse, always store

The whole point of a strong password is that it's unique per site. You will not remember 40 unique 20-character strings. Use a password manager (Bitwarden, 1Password, or even your browser's built-in manager) and let it store what the generator produces. The generator runs entirely in your browser — no password you generate is ever transmitted anywhere.

Related tools

For non-password secrets, use UUID Generator (UUIDs are ~122 bits of entropy). For API keys or tokens, the random string generator lets you control the exact alphabet. To hash a password for storage, use the hash generator (SHA-256 or bcrypt — never MD5 for passwords).