What makes a strong password?

A strong password is long, unique, and difficult to predict. Length usually contributes more than clever substitutions, while a broad character pool increases the number of possible values. The estimate above describes length and pool size; it cannot measure reuse, exposure, or how a password will be stored by a service.

How secure password generation works

This generator uses crypto.getRandomValues(), the browser interface for cryptographically strong random values. It also places at least one character from every selected group before shuffling the result. Generated passwords remain in browser memory and are never placed in local storage, a URL, analytics, or a server request.

Recommended password length

16–20 characters

A practical default for a unique password made from several character groups.

24+ characters

Useful when a service accepts longer passwords and you will store the result in a password manager.

Password vs passphrase

A generated password packs randomness into a compact value. A passphrase uses several randomly selected words and can be easier to type. Either approach should be unique. Store important credentials in a reputable password manager rather than reusing or memorizing small variations.

Frequently asked questions

Are generated passwords uploaded or stored?

No. Generation, display, and entropy estimation happen locally. Reloading or closing the tab clears the value.

Is a six-digit PIN a secure password?

No. The PIN preset is clearly separated for systems that specifically require numeric codes. It has far fewer possibilities than the default password preset.

What does estimated entropy mean?

It is length × log₂(pool size), a useful comparison under an ideal random model. It is not a guarantee about a particular account or storage system.