How to Generate a Secure Password (and What Actually Makes One Strong)
Most password advice is a decade out of date. Length beats complexity, and where the randomness comes from matters more than which symbols you include.
Quick answer
Each additional character multiplies the number of possible passwords, while adding one more character class only widens the alphabet slightly. A 20-character lowercase passphrase is dramatically harder to brute-force than an 8-character password packed with symbols.
Length beats complexity
Each additional character multiplies the number of possible passwords, while adding one more character class only widens the alphabet slightly. A 20-character lowercase passphrase is dramatically harder to brute-force than an 8-character password packed with symbols.
As a practical baseline: 16 characters for ordinary accounts, 20 or more for password managers, email and anything financial.
Entropy in one paragraph
Entropy measures unpredictability in bits. Every extra bit doubles the guessing effort. Under 50 bits is weak, 60 to 80 bits is reasonable for most accounts, and above 100 bits is comfortably beyond brute force with current hardware. A generator that shows an entropy estimate lets you compare options honestly instead of relying on a vague strength meter.
Substitutions do not work
Replacing a with @ and o with 0 in a dictionary word adds almost nothing, because cracking tools apply exactly those substitution rules automatically. P@ssw0rd! is not meaningfully stronger than password. Random generation is the only reliable approach.
Passphrases as an alternative
Four to six random words from a large word list produce a password that is both memorable and strong. This is ideal for the handful of passwords you must actually type from memory, such as your device login and your password manager master password.
Where randomness must come from
A secure generator uses a cryptographically secure random source — crypto.getRandomValues in the browser — not Math.random, which is predictable. Just as importantly, a generated password should never be transmitted anywhere. If a generator produces passwords on a server, that server has seen your password.
Ambiguous characters
Excluding visually similar characters such as 0, O, I, l and 1 slightly reduces the alphabet but prevents transcription errors when a password must be read aloud or typed from a screenshot. Compensate by adding two or three extra characters of length.
Tools mentioned in this guide
FAQ
How long should a password be in 2026?
At least 16 random characters for normal accounts, and 20 or more for email, banking and your password manager master password.
Is generating a password in the browser safe?
Yes, provided the generator uses crypto.getRandomValues and never sends the result over the network. You can verify this in your browser's network tab.