—
Pick at least one character type.
🔒 Generated with your browser’s secure random generator. The password is never transmitted.
What makes a password strong?
Two things: length and randomness. A long password drawn from a big pool of characters has more “entropy” — a measure (in bits) of how hard it is to guess. Every extra character roughly doubles the work for an attacker. We’d suggest 16+ characters for important accounts, and a different password for every site.
Bits of entropy, in plain English
- Under 50 bits — weak; fine for throwaway logins only.
- 60–80 bits — strong for everyday accounts.
- 100+ bits — excellent; effectively unguessable.
The real fix for “too many passwords” is a password manager — it generates and remembers a unique strong password per site so you don’t have to.
Is this password really safe to use?
Yes. It’s generated locally using
crypto.getRandomValues — the same secure randomness browsers use for encryption — and it never leaves your device. Reloading the page forgets it entirely.Should my business enforce password rules?
Strong unique passwords plus multi-factor authentication stop the vast majority of account takeovers. Setting that up across a team — with a password manager and MFA — is something we help businesses roll out.