What is a strong password?
One that is long, random and used on one site only. Sixteen random characters or five random words is a good target.
Generate a strong random password, a passphrase of real words or a PIN. It is made on your device and copied in one click.
Cracking it at 100 billion guesses a second would take longer than the universe has existed.
Any characters a site will not accept, such as & or %.
Up to 100 at once, to copy or save as a text file.
Every character is drawn from your browser's secure random source, the same one password managers rely on.
Free, with no sign-up and no limit, and nothing is kept: close the tab and the passwords you made are gone.
Create a strong password in three steps, then paste it into the sign-up form.
A random 16 character password appears as soon as the page opens. Switch Type to Passphrase or PIN for other kinds.
Drag Length or type a number up to 128, and turn special characters on or off. The strength bar follows each change.
Press Copy password and paste it into the site. Save it in a password manager or your browser before leaving.
Length matters most. Each extra character multiplies the guesses an attacker needs, which is why NIST's 2025 guidance asks for at least 15 characters when a password is used on its own. Sixteen random characters from this page give about 99 bits of strength.
Randomness is the other half. Names, dates, keyboard runs like qwerty and words with a 3 in place of an E are the first things cracking tools try, however long they are. A random password generator picks every character by chance, so there is no pattern to try first.
The last rule is one password per site. When a site leaks its list, attackers try the same email and password everywhere else. A unique password keeps one leak to one account, and a password manager remembers all of them for you.
A passphrase is a few random words in a row, like Tractor-Mascot-Unpaved-Fiber7. Each word comes from the EFF's list of 7,776 common words, so five of them give about 65 bits: as strong as a random password of 10 or 11 characters, and far easier to type.
The words have to be picked by chance, not by you. A song lyric or three words that belong together is easy to guess. The UK's NCSC suggests three random words as a minimum; for your email or a password manager's main password, use five or six.
Capital letters and a number satisfy sites that insist on them, and a space or a dot between words is quicker to type on a phone. Diceware passphrases work the same way, with dice choosing the words instead of your browser.
Every character comes from your browser's crypto random source, with no letter favoured over others.
Turn uppercase, lowercase, numbers and symbols on or off, and leave out any a site will not take.
Passphrases of real words, with capitals and a digit when a site asks, are easy to type and recall.
PINs of 3 to 12 digits for a phone or bank card, skipping 1234, 0000 and other codes tried first.
Make up to 100 passwords at once for new staff or test accounts, then copy them or save a text file.
See the strength in bits and the time to crack as you change a setting, worked out from the method.
Are password generators safe? This one makes every password inside your browser and keeps none.
Passwords are made by code running in this tab and never sent. Once loaded, it even works offline.
Nothing is saved, not even your settings. Reload the page and the old passwords are gone for good.
A free password generator with no sign-up and no daily limit. Make as many as your accounts need.
One that is long, random and used on one site only. Sixteen random characters or five random words is a good target.
At least 15 characters, as NIST advises for a password used alone. Longer costs nothing when a password manager types it.
Any mark that is not a letter or a digit, such as ! # $ % & * or @. Many sites count a space as one too.
A password made of several random words, like Velvet-Oyster-Walnut-Prism. Its length makes it strong, yet easy to type.
Something like r7#Tq!x2Lp9@vWm4. Never use an example you have seen online, as attackers add those to their lists.
Only when you think it has leaked. NIST no longer advises changes on a schedule, which lead to weaker, predictable passwords.
At 100 billion guesses a second, 8 lowercase letters last a second. Sixteen random characters outlast the universe.
Let a password manager or your browser keep them, and learn one strong passphrase to open it. A note at home is fine too.
Still stuck, or found a problem? Email dobliquestudio@gmail.com and we will help.