How to generate a genuinely strong password

Length beats complexity, requiring every character type makes a password weaker, and most strength meters are guessing. Here is what actually matters.

A password's strength is not a property of how it looks. "P@ssw0rd!" has upper case, lower case, a digit and a symbol, and it is terrible. Strength is a property of the process that produced it: how many equally likely passwords could have come out instead.

That count, expressed in bits, is called entropy. Each extra bit doubles the number of possibilities. A password with 60 bits of entropy is one of about 10¹⁸.

Step-by-step

1. Set a length. This is the single most effective control. Longer beats cleverer, every time.
2. Choose character sets. Lower case, upper case, digits, symbols.
3. Generate, and read the entropy. The figure shown is calculated from the actual number of possibilities, not estimated from a rule of thumb.
4. Store it in a password manager. A generated password you cannot remember is only useful if something else remembers it.

Requiring one of every type makes it weaker

This surprises people, so the tool shows you the cost. "Must contain at least one of each type" is a rule that removes passwords from the pool — every candidate lacking a digit is now forbidden. A smaller pool is less entropy, by definition.

The effect is small for long passwords and meaningful for short ones. The generator counts it exactly, using inclusion–exclusion over the character groups, and tells you how many bits the requirement cost you. Turn it on when a site demands it; do not turn it on because it feels safer.

Where the randomness comes from

From crypto.getRandomValues(), your browser's cryptographically secure generator — never from Math.random(), which is fast, predictable, and entirely unsuitable. Selecting a character from an alphabet also uses rejection sampling rather than a remainder, so no character is quietly more likely than another.

Frequently asked questions

Is the password sent anywhere?

No. It is generated in your browser and never transmitted. No analytics event on the page is permitted to carry a generated value.

How many bits do I need?

For an account protected by a service that stores passwords properly, and that locks out after repeated failures, well over 40 bits is ample. For something that might be attacked offline — a disk image, an encrypted archive, a password manager's master password — aim considerably higher and prefer a passphrase you can actually remember.

Why does requiring every character type reduce entropy?

Because it shrinks the set of allowed passwords. Every candidate without a digit is excluded, so there are fewer possible outcomes, and fewer possibilities is less entropy. The generator shows you exactly how many bits it costs.

Should I change my passwords regularly?

Not for its own sake. Routine expiry encourages small predictable edits, which is why current guidance from bodies like NIST advises against it. Change a password when you have reason to think it is exposed.