Why you need strong passwords
Weak and reused passwords are the number-one cause of account takeovers. Attackers use software that tries billions of guesses per second, plus lists of passwords leaked in past breaches. A password like 123456 or john1990 falls in under a second, while a random 16-character mixed password would take millions of years.
How the generator works
We use the browser's built-in crypto.getRandomValues, a cryptographically secure random number generator (CSPRNG) designed for security — unlike the predictable Math.random. We also guarantee at least one character from each set you choose and avoid statistical bias. Everything happens on your device; passwords are never transmitted or stored.
Three kinds of passwords
- Characters: the strongest per character, ideal with a password manager. We recommend 16+ characters.
- Passphrase: random words like
Maple-rocket-velvet-orbit-ruby-42— easy to remember and type, and very strong thanks to length. Great for your computer login or password-manager master password. - PIN: digits only, for bank cards and phone locks. Avoid dates and sequences like 1234.
Golden rules for account security
- Use a different password for every account so one breach doesn't expose the rest.
- Store them in a password manager such as Bitwarden, 1Password or your browser's built-in manager.
- Turn on two-factor authentication (2FA) for email, banking and social media.
- Never share passwords by message or email, or leave them on visible notes.
- Change a password immediately if a service you use reports a breach.
To protect a secret note or file with a password, use Encrypt Text & Files.
Frequently Asked Questions
Are generated passwords really secure?
Yes. They come from a cryptographically secure generator in your browser and are never sent or stored.
How long should a password be?
At least 12 characters, and 16+ for important accounts. For passphrases, 5+ words.
How do I remember complex passwords?
Don't — use a password manager and memorize just one strong passphrase as the master password.
Is the strength checker safe?
Yes, checking happens entirely in your browser. Still, avoid typing real passwords into sites you don't trust.
How is crack time estimated?
We assume an attacker trying 10 billion guesses per second — a rough figure for comparison.
Last updated: