What Makes a Password Strong?
A strong password is hard for a person or a program to guess. Three things matter most. Length: each extra character multiplies the number of possibilities. Randomness: a password built from a name, a date or a pattern like "qwerty" can be guessed far faster than its length suggests. Uniqueness: if you reuse a password and one website is breached, attackers try it everywhere else. This generator solves the first two. A password manager solves the third.
How to Use the Password Generator
- Choose Password, Passphrase or PIN.
- Set the options below the result. A new result appears each time you change one.
- Check the strength rating and bits of entropy.
- Press Copy, then paste it into the site and save it in your password manager.
You can generate up to 20 at once, hide them on screen if someone might be looking, and download the list as a text file. Delete that file after you have saved the passwords somewhere safe.
Password, Passphrase or PIN?
- Password: a random mix of characters, such as
vT7#kq!2Rm9x. It is the strongest per character and best when a password manager remembers it for you. - Passphrase: several random words, such as
Lantern-Meadow-Copper-Falcon-Orbit. It is easier to type and remember. It is a good choice for a password manager's master password or a device you unlock by hand. The words are picked at random from a list of 633 common words, so each word adds about 9.3 bits. - PIN: digits only. A 6-digit PIN has only about 20 bits, so it is guessable. Use PINs only where the service locks you out after a few wrong tries, such as a phone or a bank card.
Understanding Strength and Entropy
Entropy, measured in bits, describes how many guesses are needed on average. Every extra bit doubles the work. For a random password it is the length multiplied by log2 of the number of available characters. A 16-character password from 85 characters has about 102 bits. For a passphrase it is the number of words multiplied by about 9.3. A five-word passphrase from this list has about 47 bits, similar to a random 8-character password of letters, numbers and symbols at about 51 bits. For important accounts, use seven or more words, which is about 65 bits, or a long random password.
The tool also shows an estimated time to guess. It assumes an attacker who has a stolen, fast-hashed password file and tries 10 billion guesses per second. Real attacks vary a great deal, so treat the figure as a comparison between passwords, not a promise. The estimate only applies to results that were truly random, which these are, and not to a password you changed by hand.
What the Options Do
- Length: 8 to 128 characters. Aim for at least 14 to 16 for ordinary accounts, and longer for email and finance.
- Avoid look-alike characters: removes I, l, 1, O, 0 and o, which helps if you must read or type the password.
- Avoid ambiguous symbols: removes brackets, quotes and punctuation that some sites and systems mishandle.
- Include at least one of each type: satisfies sites that demand a capital, a number and a symbol.
- No repeated characters: every character appears once. It looks tidier, but it slightly reduces strength, and the entropy figure is adjusted to match.
- Start with a letter: for systems that reject passwords beginning with a symbol or number.
- Custom symbols and excluded characters: fine-tune the set when a site allows only certain symbols.
If a site refuses your password, turn off symbols and increase the length instead. A longer password with fewer character types can still be very strong.
How to Store and Use Passwords Safely
- Use a reputable password manager so you only remember one master passphrase.
- Use a different password for every account.
- Turn on two-factor authentication, preferably with an authenticator app, for email, banking and social accounts.
- Change a password promptly if a service reports a breach.
- Never send passwords by chat or email, and never share one-time codes.
Accounts That Hold Money
Strong, unique passwords matter most for accounts that can lose money, such as exchanges, wallets and online banking. Add two-factor authentication, and never type a wallet recovery phrase into a website. If you trade crypto, the Crypto Profit Calculator on Lumara's crypto site works out the gain or loss on a trade. It needs only prices and quantity, and never asks for a password or keys.
Names and Web Addresses Are Different
Usernames, file names and page addresses need to be readable, not secret, and they should never be used as passwords. The Text to Slug Converter turns a title into a clean, lowercase string for those jobs. Because its output follows a predictable pattern, it is not suitable for a password.
Common Mistakes
- Reusing one password on many sites.
- Adding "1" or "!" to the end of a word and calling it strong.
- Using personal facts such as names, birthdays or phone numbers.
- Saving passwords in a plain note or a shared document.
- Choosing a short PIN or password where there is no lockout after wrong tries.
Frequently Asked Questions
Is it safe to use an online password generator?
This generator creates passwords in your browser using the browser's cryptographic random number generator. It does not send them to our servers or save them. The page also loads a cookie banner and an advertisement from third-party services, described in our Privacy Policy. No website can be fully proven safe from a visitor's side, so for your most important accounts, the generator built into a trusted password manager is an equally good choice.
How long should my password be?
At least 14 to 16 random characters for ordinary accounts, and longer for email, banking and a password manager. For a passphrase, use at least six or seven words.
Is a passphrase better than a password?
A random password is stronger per character. A passphrase is easier to type and remember, and it can be just as strong if it has enough random words.
Does the order of generated passwords matter?
No. Each result is independent and equally random.
Why do some sites reject my password?
Some sites limit length or symbols. Try the options for avoiding ambiguous symbols, custom symbols or a shorter length.
Are the recent results saved?
They are kept in memory on this page only, so you can recover one by accident. They disappear when you reload or close the page.