How to use it
Pick length and types
16+ characters with all four types is enough for any account. Every type you pick appears at least once.
Or a passphrase
In the Passphrase tab: 5 or more words that are easy to remember and type on a phone.
Copy and save it
Copy it straight into your password manager or account settings.
How many bits do I need?
Strength in bits counts the possibilities: every extra bit doubles them.
| Strength | Example | Rating |
|---|---|---|
| Under 40 bits | 8 lowercase letters | Weak: cracked fast if leaked |
| 40–60 bits | 10 mixed characters | Fair |
| 60–80 bits | 12 characters, all four types | Strong |
| 80+ bits | 16 characters or 7 words | Very strong |
Password tips
One password per account. When one site leaks, attackers try the same password on your email and bank. A different one per account stops that.
Use a password manager. Google’s, Apple’s or Bitwarden: it stores and fills passwords so you don’t have to remember them.
Turn on two-step verification. Even the strongest password can be phished; a code or security key protects you then.
FAQ
Are these passwords safe?
Yes. They are made in your browser with crypto.getRandomValues, every character is exactly equally likely (no bias), and they are never sent or stored; we never see them.
How long should a password be?
12 characters is the minimum, 16 is better. Length beats symbols: 16 lowercase letters are stronger than 8 of every type.
What is a passphrase?
Random words joined together, like Crane-Bucket-Velvet7-Orbit-Lunar: easier to remember and type, with strength from the number of words (5 words from our list ≈ 68 bits).
Can I check my current password?
Yes, with the Password Strength Checker, which also runs in your browser.