How to generate a password you can actually trust

Every account you create asks for a password. Most of those accounts will, sooner or later, leak. The good news: a strong password is cheap to produce and a password manager will remember it for you.

What "strong" actually means

Password strength is measured in bits of entropy — the log₂ of the number of possible passwords given your generation rules. The more bits, the longer an attacker has to guess.

• 40 bits: about a trillion possibilities. Falls in minutes to a serious GPU attack.
• 60 bits: about a quintillion. Falls in days.
• 80 bits: about a septillion. Falls in decades.
• 128 bits: essentially forever.

The Password Generator produces passwords at the bit-count of your choice. Defaults give around 80 bits — strong enough for any normal account, well past the threshold where the actual weak link is your password manager's master password or your 2FA.

The four ingredients

A random password is built from a character set of size N, repeated L times. The entropy is L × log₂(N):

• All-lowercase, 26 characters: ~4.7 bits per character.
• Lowercase + uppercase: 52 chars → ~5.7 bits per character.
• Add digits: 62 chars → ~5.95 bits per character.
• Add symbols: 95+ chars → ~6.5 bits per character.

So a 12-character password from the full set has about 78 bits. A 16-character password from lowercase-only is about 75 bits. Both are strong; both are fine.

Length matters more than complexity. Going from 8 to 16 characters is a billionfold improvement. Adding one symbol to an 8-character password barely doubles it.

How to use the tool

1. Set the length. Default to 20+ characters for anything you don't memorise.
2. Toggle the character classes you want. For accounts that reject certain symbols (still common in 2026), turn off symbols entirely. The entropy loss is mostly recovered by adding one or two characters of length.
3. Click Generate. Copy. Paste into your password manager.

You should never type a generated password into a login field by hand. Always paste, always store, never see it again.

Things the generator doesn't do

• It doesn't store passwords. Nothing leaves the page. The browser's Web Crypto API generates them; nothing is logged.
• It doesn't check against breach databases. "Have I Been Pwned" does that for you with the password's SHA-1 hash. A freshly-generated 80-bit password is, statistically, not in any breach database — but if you want to be sure, check after generation.
• It doesn't pick "memorable" passwords. That's the wrong objective. Memorability is an anti-feature for passwords; you should be storing them, not memorising them.

The bigger picture

The password is one slice of your account security. The others are: a unique master password for your password manager (memorise this one), 2FA enabled wherever possible (TOTP preferred over SMS), and email account specifically protected with hardware 2FA (because email resets every other password).

If you've done all of that, generating a 20-character random password takes two clicks and forgets it ever existed. As it should be.