Password Generator & Strength Checker
By Stuart Mathieson · Updated October 2026
Tips for a strong password:
- Use at least 12 characters
- Mix uppercase and lowercase letters
- Include numbers and symbols
- Avoid common words and patterns
- Don't reuse passwords across sites
How the password generator works
Each character is picked at random from 88 possibilities: 26 uppercase letters, 26 lowercase letters, 10 digits and 26 symbols. The randomness comes from your browser's cryptographically secure random number generator (crypto.getRandomValues), the same kind of source used for encryption keys.
One character from each group is guaranteed, then the whole password is shuffled so there's no way to tell which characters were guaranteed.
How strong is a random password?
Strength is measured in bits of entropy. Each extra bit doubles the number of guesses an attacker would need, and each random character chosen from 88 adds about 6.46 bits:
| Length | Entropy |
|---|---|
| 8 characters | about 52 bits |
| 12 characters | about 78 bits |
| 16 characters | about 103 bits |
| 20 characters | about 129 bits |
| 32 characters | about 207 bits |
Guaranteeing one character from each group removes a tiny amount of randomness, which barely changes these figures.
Choosing and using passwords
- Length matters most. NIST's digital identity guidelines (SP 800-63B-4) set a minimum of 15 characters for passwords used on their own, and tell websites not to force particular character mixes or regular password changes.
- One password per account. Reusing a password means one breach can unlock several accounts. CISA recommends a password manager, and passwords of at least 16 characters - either random characters or a passphrase of 5-7 unrelated words.
- Add a second factor. Multi-factor authentication protects an account even if a password is stolen.
- About the strength checker. It is a quick rule-of-thumb check that scores length, character variety and a few common patterns such as "password" or "123456". It can't know whether a password has appeared in a data breach, and a long passphrase can be strong even if the checker rates it lower.
Frequently asked questions
Is the generated password truly secure?
Yes - it uses your browser's cryptographically secure random number generator, the same kind of randomness source used for security-sensitive applications, not a simple pseudo-random function.
Is my password sent anywhere?
No - generation and strength analysis both happen entirely in your browser. Nothing is transmitted or stored.
What makes a password strong?
Length matters most - NIST's current guidelines set a minimum of 15 characters for passwords used on their own, and 16 or more is a good default. Use random characters or several unrelated words, use each password for only one account, and avoid common words and predictable patterns.
How long should my password be?
At least 15 characters if the password is your only protection, following NIST's current guidelines. 16 or more is a good default, and with a password manager a longer password costs you nothing extra.
Sources
- Digital Identity Guidelines: Authentication and Authenticator Management (SP 800-63B-4) - National Institute of Standards and Technology
- Use Strong Passwords - Cybersecurity and Infrastructure Security Agency