How to create a strong password
- Choose the length. 20 characters is a good default.
- Pick the character types the website accepts.
- Copy the password into your password manager. Press Generate for a new one.
How strong is strong?
| Password | Entropy | Verdict |
|---|
| 8 characters, all types | ~52 bits | Fair |
| 16 characters, letters + digits | ~95 bits | Strong |
| 20 characters, all types | ~130 bits | Very strong |
Good habits
- Use a different password for every site, and keep them in a password manager.
- Turn on two-factor authentication where you can.
- Never reuse a password that appeared in a data breach.
Questions and answers
- Is it safe to generate passwords on a website?
- Here, yes: passwords are created in your browser with the Web Crypto random generator and are never sent or stored. You can disconnect from the internet and it still works.
- How long should a password be?
- At least 16 characters for important accounts. Length adds more strength than symbols do.
- What does “bits of entropy” mean?
- It measures how many guesses an attacker would need. Every extra bit doubles the work; 80 bits or more is out of reach for brute force.
- Why avoid look-alike characters?
- Characters like 0 and O or 1 and l are easy to mistype when you read a password aloud or copy it by hand.
Updated November 14, 2026