Free Strong Password Generator

For anything that matters, 16 characters or more is a sensible floor, and longer is always stronger. Length beats cleverness: adding four characters does far more than swapping letters for symbols. Since a password manager types it for you, there is little cost to going to 20 or beyond for important accounts.

Use a random password when a manager will store and fill it, since you never need to read it. Use a passphrase when a human has to remember or type it, like a laptop login, a wifi key, or a code you read out over the phone. Words are far easier to type correctly, and each extra word adds real strength. The meter shows you honestly where your word count lands, so add words until it says strong.

Two things: how many possibilities each character has, and how many characters there are. Together they give the entropy, measured in bits, and each extra bit doubles the number of guesses an attacker needs. Randomness matters too. A long password built from your dog and your birth year is weak because attackers try patterns like that first. A truly random one has no pattern to try.

Yes, without exception. When one site is breached, attackers take the leaked passwords and try them everywhere else, which is called credential stuffing. A unique password per account means one breach stays one breach. Nobody can remember dozens of random passwords, which is why a password manager is the right tool: it remembers them, fills them, and you only memorise one strong passphrase to unlock it.

They are characters that look nearly identical in many fonts: the digit 0 and the letter O, the digit 1, lowercase l, uppercase I and the pipe symbol. If a password only ever lives in a manager they are harmless. But if someone has to read it off a screen or type it from paper, they cause real mistakes, so the avoid look-alikes option drops them from the pool.

It computes entropy from your actual settings. For a random password that is the length times the log of the character pool size, so a 16 character password from a 94 character pool is about 105 bits. For a passphrase it is the number of words times the log of the word list size. The crack time line then assumes an attacker making ten billion guesses per second, which is realistic for offline attacks on weakly hashed passwords.

No. The whole tool is JavaScript running in your browser. There is no request when you generate, no analytics event containing a password, no storage of any kind. When you leave the page the passwords are gone unless you copied them somewhere yourself.

Yes. A generator covers the personal side, but business apps need the whole picture: sign-up and login flows done properly, password hashing that follows current guidance, single sign-on with Google or Microsoft, two-factor authentication, and a review of where credentials and sessions could leak. That is the kind of security-minded build work we do at Techliphant.