How to Generate a Strong Password

A strong password is one that's hard to guess and hard to brute-force. That comes down to math, not cleverness — and the math favors length and randomness over memorable tricks. Here's what matters.

Entropy is the real measure

Password strength is measured in entropy — bits of unpredictability. Each character multiplies the number of possibilities by the size of the character pool, so entropy is length × log₂(pool size):

• 26 lowercase letters → about 4.7 bits per character
• Add uppercase, digits, and symbols (~94 characters) → about 6.5 bits each

A 20-character password from the full set carries roughly 130 bits — far beyond what any brute-force attack can reach. As a rough guide: under 40 bits is weak, 60–80 is good, and 80+ is strong.

Length beats complexity

Adding one character multiplies the search space; swapping a for @ barely changes it and hurts memorability. If you must choose, make it longer. A long passphrase of random words can be as strong as a short symbol soup, and easier to type.

Why use a generator

Humans are bad at randomness — we reuse patterns, keyboard walks, and dates a cracker's dictionary already knows. A generator draws every character from a cryptographic random source, so there's no pattern to exploit. Pair it with a password manager so length and uniqueness cost you nothing to remember.

Related

Part of Web Security Essentials; see How to Store Passwords Securely for the other half. Also the UUID Generator for random identifiers and the Hash Generator for MD5 and SHA digests.

Try it

Set a length, pick your character types, and get a strong password instantly — it's generated in your browser and never uploaded.