Password Generator

What makes a password strong

Strength comes from unpredictability, measured in bits of entropy. Each extra character multiplies the number of possible combinations, so length matters more than exotic symbols. A 16-character password drawn from all four character sets has roughly 100 bits of entropy — far beyond what brute force can reach — while an 8-character one sits near 52 bits.

Random password or passphrase?

Random strings are ideal for anything stored in a password manager. Passphrases — several unrelated words joined together — are far easier to type and remember, which makes them a good fit for a device login or the master password of a vault. Four random words from this list plus a number give about 38 bits; use five or six words for anything important.

Practical habits

• Use a different password for every account, so one breach cannot spread.
• Store them in a password manager rather than a note or spreadsheet.
• Turn on two-factor authentication wherever it is offered.
• Change a password immediately if a service reports a breach — no rotation schedule needed otherwise.
• Exclude ambiguous characters when a password has to be read aloud or typed from paper.