How to Generate a Strong Password Online

One password guards your email, and your email can reset almost everything else: your bank, your photos and your social accounts. Yet most people still protect all of that with a password invented in seconds — a name, a year, a word with a number on the end — reused everywhere. The trade-off is hard: passwords that are easy to remember are easy to guess.

A password generator breaks that trade-off: it produces one that is long, mixed and unlike anything you would think up yourself, and you store it in a password manager instead of memorising it. This guide shows how to generate a strong password online in seconds, what "strong" means in numbers, and the mistakes that undo even a good password.

What makes a password strong

A strong password is long, random and unique to one account. Length matters most, because every extra character multiplies the possible passwords. Randomness matters because attackers try the passwords people actually use first: names, dates, dictionary words, keyboard patterns and leaked passwords from past breaches. Uniqueness matters because if one site leaks your password, every account sharing it falls with it.

That is why "Summer2024!" is weak despite ticking the usual boxes: it follows a pattern millions of people use. A random 16-character string with upper- and lowercase letters, digits and symbols has no pattern to exploit — the only way through is trying combinations, and as the worked example shows, there are far too many.

The Password Generator shows two helpful numbers for every password: a strength label and its entropy in bits. Entropy measures unpredictability: each extra bit doubles the possible passwords. The generator's 16-character example with all four character sets on shows 104 bits — about 6.5 bits per character. That is the honest way to compare passwords.

Generate a strong password in 5 steps

1. Open the Password Generator — it runs entirely in your browser, and the passwords it creates are generated locally, never sent anywhere.
2. Set the length. Move the slider to choose between 4 and 64 characters. The default of 16 suits most accounts; for email, banking and your password manager itself, consider 20 or more. Length is the single biggest lever you have.
3. Keep all four character sets switched on. Uppercase (A–Z), lowercase (a–z), digits (0–9) and symbols are all ticked by default, making each character less predictable. At least one set must stay on; for a normal password there is no reason to switch any off.
4. Click Generate. You get a fresh random password instantly, with its strength and entropy shown. Click Generate again for a different one — every click produces a new, independent password.
5. Click Copy, then store it safely. Paste it where needed, and save it in a password manager rather than a plain note, chat message or email to yourself. A password you cannot find again is one you will reset — and resets are when people fall back to something weak.

A worked example: what 104 bits really means

Take the generator's 16-character example with all four sets on: 104 bits of entropy. That means 2¹⁰⁴ possible passwords — about 2.03 × 10³¹. Even at an illustrative one billion guesses per second, trying them all would take about 2.03 × 10²² seconds, roughly 6.4 × 10¹⁴ years. Nobody is going to brute-force that password.

Now compare an 8-character lowercase-only password. Each character carries log₂(26) ≈ 4.70 bits, so 8 characters give about 37.6 bits: 2^37.6 ≈ 2.09 × 10¹¹ combinations. At the same illustrative speed, that is about 209 seconds — roughly three and a half minutes. The difference is not a little extra safety; it is minutes versus hundreds of trillions of years.

The table below uses the same arithmetic, at the same illustrative guessing speed:

Password	Entropy (approx.)	Guessing time at 1 billion guesses/second (illustrative)
8 characters, lowercase only	~38 bits	~3.5 minutes
8 characters, all four sets	~52 bits	~52 days
12 characters, all four sets	~78 bits	~9.6 million years
16 characters, all four sets	104 bits (shown by the tool)	~640 trillion years
20 characters, all four sets	~130 bits	~4.3 × 1022 years

Two caveats. First, these times assume pure guessing. Real attacks try leaked passwords, dictionary words and patterns first — which is exactly why a random generated password beats a clever-looking invented one. Second, guessing speed is illustrative, and many attacks do not guess at all, they phish. Length protects against guessing; only uniqueness, careful handling and two-factor authentication protect against the rest.

A passphrase of genuinely random words is a respectable alternative where you must memorise a password, such as your manager's master password — but words from a favourite quote are not random. For everything else, a generated password stored in a manager is simpler and stronger.

5 mistakes that undo a strong password

• Reusing it across accounts. A strong password used on ten sites is only as safe as the weakest of them. One leak and attackers try it everywhere. Generate a fresh password for every account that matters.
• Making it "memorable". Names, birthdays, pet names, favourite teams and keyboard walks like "qwerty" are among the first things attackers try. If your password means something to you, it is easier to guess.
• Keeping it short. Adding a symbol to an 8-character password helps a little; adding four more characters helps far more. When in doubt, go longer rather than fancier.
• Sharing or exposing it. Never send a password by chat, email or screenshot, or read one aloud where others can hear. If someone needs access, use the service's own sharing or guest feature, not your password.
• Storing it in plain text. A sticky note, unprotected document or phone note labelled "passwords" turns one stolen device into every account. Use a password manager, and switch on two-factor authentication for important accounts.

Frequently asked questions

What counts as a strong password?
One that is long, random and unique to one account. In practice: at least 16 characters, generated randomly with upper- and lowercase letters, digits and symbols, never reused. The generator's entropy reading is a quick check — more bits, harder guessing job.

How long should my password be?
Sixteen characters is a good default, and it is what the generator starts at. For email, banking and your password manager, 20 or more is worth it — the extra length costs nothing when a manager stores it.

Is it safe to use an online password generator?
With this one, yes — its privacy note states passwords are generated locally with your device's cryptographic random generator and never sent anywhere. Use the site's own page rather than a lookalike.

What if I forget a generated password?
That is expected — you are not meant to memorise it. Save it in a password manager. If you did not save it, use the account's official "forgot password" reset rather than falling back to a weaker password. If you suspect a leak, change it at once.

Related tools: Password Generator · Password Strength Checker · Random Number Generator · QR Code Generator