What makes a strong password
Strength comes from length and randomness, measured in bits of entropy — each bit doubles the number of guesses an attacker needs. A random 16-character password with mixed types has ~100 bits, far beyond brute-forcing. A memorable word, however clever, has very little.
| Entropy | Rating |
|---|---|
| Under 40 bits | Weak |
| 40–60 bits | Fair |
| 60–90 bits | Strong |
| 90+ bits | Very strong |
Good password habits
- A unique password per account — reuse is how one breach becomes many.
- Use a password manager to store these; you don't need to memorise them.
- Turn on two-factor authentication where you can.
Private by design. Passwords are generated with
crypto.getRandomValues in your browser and never transmitted. This site is static.Frequently asked questions
Are these passwords safe?
Yes — generated with the browser's cryptographic random source and never uploaded. They exist only on your device.
How long should a password be?
At least 12 characters; 16+ for important accounts. Length beats complexity.
What does “exclude look-alikes” do?
Removes l, 1, I, O, 0 so the password is easier to read and type by hand.
Is the password stored or uploaded?
No — it's shown only in your browser and never saved by us.
More free tools
Security/dev: Hash Generator · See all Alienated Tools.