How-to guide

How to Generate a Secure Password

To generate a secure password, use a generator backed by a cryptographically secure random source rather than inventing one yourself. Choose length over complexity: a long random password or a multi-word passphrase resists attack far better than a short string padded with symbols. Store the result in a password manager, since a password you can memorise is usually one an attacker can guess.

Password Generator

Create strong random passwords or memorable passphrases.

Open the tool

Password strength is measured in entropy — the number of equally likely possibilities an attacker must search. Entropy comes from genuine randomness and length, not from decoration. Substituting 3 for e and appending an exclamation mark adds almost nothing, because cracking tools have applied those substitutions as standard for decades.

Human-chosen passwords are the weak point. People pick words, names, dates and keyboard patterns, and they reuse them. A generator removes the human from the choice, which is the entire point.

Step by step

Choose a length before anything else
Length dominates every other factor. Sixteen characters is a sensible floor for a random password and twenty or more is better for anything protecting money, email or infrastructure.
Pick random characters or a passphrase
A random character string maximises entropy per character. A passphrase of four or five random words is easier to type on a phone or read aloud, and reaches comparable strength by being longer.
Turn on the character sets the site accepts
Include uppercase, lowercase, digits and symbols where permitted. Some systems reject certain symbols; exclude those rather than shortening the password to compensate.
Exclude ambiguous characters only when needed
Removing lookalikes such as l, 1, I, 0 and O helps when a password must be read aloud or copied by hand. It slightly reduces entropy, so add a couple of characters to compensate.
Store it in a password manager
A generated password is only useful if you do not need to remember it. Save it immediately, and never reuse it across sites — reuse is what turns one site's breach into a compromise of all your accounts.
Add multi-factor authentication
A strong password still fails if it is phished. Multi-factor authentication, ideally with an authenticator app or a hardware key rather than SMS, is the control that limits the damage.

Example

Both resist offline attack well. The passphrase is longer but far easier to type on a phone.

Random password, 20 characters

v7#Kq2wRt9$Lm4Zx8Np1

Passphrase, 5 words

harbour-quartz-lantern-drift-marble

Frequently asked questions

Where does the randomness come from?

crypto.getRandomValues(), the browser's cryptographically secure random number generator. It is seeded by the operating system and is suitable for generating secrets, unlike Math.random(), which is not.

Is the generated password sent anywhere?

No. Generation happens entirely in your browser and nothing is transmitted, logged or stored. Closing the tab discards it, so save it to a password manager before you navigate away.

Are passphrases weaker than random passwords?

Not if the words are chosen randomly and there are enough of them. Four or five randomly selected words from a large list give strength comparable to a shorter random string, and are far easier to type. The catch is that words you choose yourself are not random.

Do I still need to change passwords regularly?

No. Current guidance from NIST and the UK NCSC advises against forced routine rotation, because it pushes people towards predictable variations. Change a password when there is a reason to: a breach, a suspicion, or shared access ending.

What length should I actually use?

Sixteen random characters is a reasonable floor for ordinary accounts. Use twenty or more for email, banking, password manager master passwords and anything with administrative access, since those protect everything else.

Tools used in this guide

All tools →

All guides →

Last reviewed 7 August 2026.