How to create a strong password
- Pick a length. Drag the slider or type a number. 16 characters is a good default; go longer for email, banking and your password manager.
- Choose characters. Uppercase, lowercase, numbers and symbols are all on by default. Switch to All symbols for maximum strength, or None if a site rejects special characters.
- Copy and save it. Click a password or its copy button, then store it in your password manager. Each change makes a fresh batch.
What makes a password strong?
A password is strong when it is long, random and unique. Attackers don't guess one password at a time by hand; they test billions of guesses per second against leaked password databases, starting with words, names, dates and common patterns. A truly random password gives them nothing to work with, so the only option left is trying every combination.
The strength meter above shows this as entropy: the number of bits an attacker has to brute-force. Every extra bit doubles the work. As a rule of thumb:
- Under 40 bits – weak, can be cracked quickly offline.
- 40–64 bits – fair, fine for low-value accounts with rate limiting.
- 64–80 bits – strong for most online accounts.
- 80+ bits – very strong, out of reach of any realistic attack.
The crack time assumes a fast offline attack of 100 billion guesses per second, which is what a well-equipped attacker can reach against a poorly hashed leaked database.
Password tips that actually matter
- Never reuse a password. When one site leaks, attackers try the same email and password everywhere else.
- Use a password manager. It remembers a different random password for every site, so you only have to remember one.
- Turn on two-factor authentication for email, banking and social accounts. It stops most account takeovers even if a password leaks.
- Skip the clever substitutions.
P@ssw0rd!is in every cracking dictionary. Randomness beats tricks.
Private by design
SuggestPassword runs entirely in your browser. The generator code downloads once, and passwords are made on your device with your browser's cryptographically secure random number generator. Nothing you generate is sent to us or anyone else, and the site works offline once loaded. You can also install it as an app on your phone or computer.
More free tools
Is this password generator safe to use?
Yes. Every password is generated locally in your browser with crypto.getRandomValues(), the same cryptographically secure random source browsers use for encryption. Passwords are never sent to our server, stored or logged. You can even disconnect from the internet and keep generating.
How long should my password be?
Use at least 16 characters for important accounts. A random 16-character password with letters, numbers and symbols has more than 95 bits of entropy, which would take longer than the age of the universe to guess. Longer is always better if the site allows it.
Do generated passwords always contain a number and a symbol?
Yes. Every character type you turn on is guaranteed to appear at least once, so the passwords pass the usual "must contain a number and a symbol" rules. We redraw the whole password instead of patching it, so every valid password is equally likely.
What does "No look-alikes" do?
It leaves out characters that are easy to confuse when you read or type them: 0 O o 1 l I and |. Use it for passwords you might need to type by hand, such as Wi-Fi keys.
Should I use a password or a passphrase?
Use a random password for anything a password manager fills in for you. Use a passphrase for the few passwords you have to remember and type, such as your password manager or computer login.
Can two people get the same password?
In theory, but the odds are vanishingly small. A 16-character password drawn from 65 characters has about 1029 possible values, so a repeat is far less likely than winning the lottery several times in a row.
Is there an API or browser extension?
Yes. Developers can use the free password generator API, and the SuggestPassword Chrome extension puts the same generator one click away in your browser toolbar.