How to create a strong password
- Set the length. 16 characters is a good default, and longer is stronger.
- Keep all four character types on unless a site rejects symbols.
- Click Copy and paste the password into the site, then save it in your password manager.
What makes a password strong?
Strength comes from length and randomness. Each extra character multiplies the number of guesses an attacker needs, so a 16-character password from all four character types has about 100 bits of randomness. That would take far longer than a lifetime to guess, even with powerful hardware.
The passwords here come from your browser's cryptographic random number generator (crypto.getRandomValues), which is built for security uses like this. Every password includes at least one character from each type you select.
Use a different password for every account. When one site leaks its passwords, attackers try the same email and password on other sites, so reused passwords spread the damage.
Frequently asked questions
Is the password sent or saved anywhere?
No. It is created in your browser and exists only on this page until you copy it. Reload the page and it is gone.
How long should my password be?
Use at least 12 characters for everyday accounts and 16 or more for email, banking and your password manager's master password.
Why avoid look-alike characters?
Characters such as capital I, lowercase l and the number 1 are easy to mix up when you type a password by hand or read it aloud. Turning the option on leaves them out.