How long should a password be?

A minimum of 12 characters for everyday accounts; 16 or more for high-risk accounts like email, banking, and work logins. Length is the single most important factor in password security.

What is password entropy?

Entropy measures unpredictability in bits. Each additional bit of entropy doubles the number of possible combinations. A password with 60 bits of entropy would take thousands of years to crack at 10 billion guesses per second — the speed of a modern GPU.

Password Generator — Secure Random Passwords

What Makes a Password Strong?

Password strength is determined by entropy — a mathematical measure of how unpredictable the password is, expressed in bits. Entropy depends on two things: the length of the password and the size of the character set it's drawn from.

A 12-character password using only lowercase letters (26 possible characters per position) has 26¹² ≈ 95 trillion combinations. Adding uppercase, numbers, and symbols expands the character set to ~94 characters: 94¹² ≈ 475 septillion combinations. But length dominates: a 20-character lowercase-only password has more entropy than a 12-character mixed-character password.

Password Entropy and Crack Times

Entropy is measured in bits, where each bit doubles the number of possible combinations. A modern GPU can attempt around 10 billion password guesses per second against a poorly hashed database. At that speed:

40 bits of entropy ≈ 1 trillion combinations → cracks in about 2 minutes.
60 bits of entropy ≈ 1 quintillion combinations → cracks in about 3,000 years.
80 bits of entropy → cracks in about 36 million years.
100 bits of entropy → cracks in about 4 trillion years.

Our strength checker calculates approximate entropy based on your password's length and character types and shows an estimated crack time in plain language.

Passphrases vs. Random Character Passwords

A passphrase — multiple random words like "maple-frozen-river-echo-ghost" — can match or exceed the security of a random character password while being far easier to remember. A 5-word passphrase drawn from a 2,000-word list has approximately log₂(2000⁵) ≈ 55 bits of entropy — more than a typical 10-character mixed-character password.

Passphrases shine for accounts you type regularly: computer logins, primary email, and password manager master passwords. For everything else, your password manager can generate and store random character passwords without you ever needing to memorize them.

How Attackers Crack Passwords

Understanding attack methods explains why the security rules exist:

Dictionary attacks — Try common words, names, keyboard patterns (qwerty, 123456), and known passwords from breach databases. Most commonly used passwords are already known.
Credential stuffing — Use stolen username/password pairs from one breach to try logging in elsewhere. This is why password reuse is catastrophic — one breach exposes every account using that password.
Brute force — Try every possible combination. Feasible for short passwords; impractical for long ones due to exponential growth.
Rainbow tables — Precomputed hash lookup tables to speed cracking. Defeated by modern "salted" hashing used in reputable services.

Why a Password Manager Is Essential

Using a unique, random password for every account is the single most impactful thing you can do for your digital security. The problem: no human can memorize dozens of 16-character random passwords. The solution: a password manager stores all passwords in an encrypted vault and auto-fills them, so you only need to remember one strong master password.

Reputable options include Bitwarden (free, open-source, audited), 1Password, and the built-in managers in Chrome, Safari, and Firefox. All of these are safer than reusing passwords or writing them down.

Two-Factor Authentication: The Second Line of Defense

Even a strong, unique password can be compromised if a service suffers a breach. Two-factor authentication (2FA) adds a second verification step — usually a time-based code from an authenticator app — so that possessing your password alone is not enough to log in.

Authenticator apps like Google Authenticator, Authy, and Microsoft Authenticator generate 6-digit codes that change every 30 seconds. These are more secure than SMS-based 2FA, which is vulnerable to SIM-swapping attacks. Enable 2FA on every account that offers it, prioritizing email, banking, and work accounts.

How This Password Generator Works

This generator uses the browser's crypto.getRandomValues() API, defined by the W3C Web Cryptography specification and implemented in all modern browsers. It draws randomness from the operating system's entropy pool, which collects unpredictable data from hardware timing, interrupt events, and other physical sources.

This is categorically different from Math.random(), which uses a deterministic pseudorandom algorithm and can theoretically be predicted given the right initial conditions. crypto.getRandomValues() is the same source used by cryptographic libraries in banking, VPNs, and security software.

Password Requirements by Account Risk Level

Not every account needs the same level of protection. A practical framework:

Critical accounts (email, banking, work login, password manager) — 16+ random characters or a 5+ word passphrase; 2FA enabled; never reused.
Medium-risk accounts (online stores, streaming, social media) — 12+ characters; unique per site via your password manager; 2FA if available.
Low-risk throwaway signups — Let your password manager generate and store automatically; you never need to know it.

Your email account is the most critical of all — it's the recovery method for every other account, making it the master key to your digital life.

Password Generator — Frequently Asked Questions

Is it safe to generate passwords on this website?

Yes. Every password is generated entirely in your browser using crypto.getRandomValues(). No password data is ever sent to a server. You can confirm this by opening your browser's Network tab while generating — there are zero outgoing requests during password generation.

What is the difference between a password and a passphrase?

A password is a random string of characters (like xK7#mQ2p). A passphrase is several random common words joined together (like maple-frost-river-echo). Both can offer equivalent security; passphrases are significantly easier to memorize and type correctly.

How long should my password be?

At minimum, 12 characters for everyday accounts. For high-risk accounts — email, banking, and work — use 16 or more characters. Length is the most important factor; a longer password is almost always more secure than a shorter one with more character types.

What does password entropy mean?

Entropy measures unpredictability in bits. Each additional bit doubles the number of possible combinations an attacker must try. A password with 60 bits of entropy has 2⁶⁰ ≈ 1 quintillion possible values — at 10 billion guesses per second, cracking it would take thousands of years.

Should I use a password manager?

Yes — it's the single most effective change you can make to your password security. Using a unique password for every account is crucial, and a password manager is the only practical way to do that. Bitwarden is free and open-source; 1Password and the built-in browser managers are also solid choices.

What Makes a Generated Password Strong: The Entropy Math

Password strength is measured in bits of entropy: length × log₂(alphabet size). Every added bit doubles the number of guesses an attacker needs, which is why length beats cleverness — each extra character multiplies difficulty by the whole alphabet, while swapping an 'a' for '@' barely moves the number.

The numbers, worked out

An 8-character lowercase-only password carries about 8 × 4.70 ≈ 37.6 bits — hardware that tests a trillion guesses per second exhausts that space in under a second. A 12-character password from letters and digits (62 symbols) has ≈ 71.5 bits. A 16-character password using the full 94 printable characters reaches ≈ 104.9 bits — around 10¹² years at the same trillion-guesses-per-second rate. That gulf between one second and a trillion years is entirely length and alphabet.

Random beats memorable-with-substitutions

Human 'clever' passwords (P@ssw0rd2026!) fall to dictionary rules that try exactly those substitutions first — their real entropy is far below the character math. A generator draws uniformly at random, so the arithmetic above actually holds. If you need something typeable and memorable, four random common words (the passphrase approach) carry ≈ 51.7 bits and are easier to type on a phone than 12 random symbols.

What to do with a generated password

Use a unique one per site — reuse, not weakness, is behind most account takeovers, because one breached site unlocks the rest. A password manager removes the memorization problem entirely; then the only passwords you memorize are the manager's and your email's. Current NIST guidance agrees: prioritize length, drop forced periodic changes, and change a password when there is evidence of compromise.

Frequently asked questions

Is it safe to generate passwords on a website?
This generator runs in your browser — the password is produced on your device by client-side code as part of a static page. Even so, the safest practice for critical accounts is a password manager's built-in generator, which also stores the result.

How long should my passwords be in 2026?
16+ random characters for anything important, and never below 12. If a site caps length, use the maximum it allows with the largest character set it accepts.

Are the 'must include a symbol and number' rules useful?
Less than length is. Composition rules mostly push people toward predictable patterns (capital first, ! last). A long random string or passphrase outperforms a short 'complex' one.

Last updated: August 9, 2026 · ConvertSnap editorial team. Conversion factors follow published international standards. Free to use, no signup — see about ConvertSnap.

Generate Secure Passwords