What makes a password strong
A password is strong when it is long, random and unique. Attackers do not guess letter by letter: they try leaked passwords, dictionary words, names and predictable patterns such as a capital first letter and a number at the end. Anything a person invents tends to follow those patterns, which is why generated passwords are far harder to crack.
Strength is measured in bits of entropy, the number of equally likely possibilities written as a power of two. Every extra bit doubles the work for an attacker, and every extra random character adds several bits, so length matters more than any single rule about symbols. Uniqueness matters just as much: if one site leaks your password, attackers try the same email and password on other sites, so never reuse one.
Random passwords versus passphrases
A random character password packs the most strength into the fewest characters: with upper and lowercase letters, numbers and symbols, each character adds about 6.5 bits, so 20 characters gives roughly 130 bits. That is ideal for accounts you store in a password manager and never type.
A passphrase strings together randomly chosen words, such as Maple-Orbit-Candle-Frost-Harbor. Each word from this tool's list of 954 adds just under 10 bits, so five words gives about 49 bits and seven words about 69. Passphrases are longer but much easier to remember and type, which makes them a good choice for the few passwords you need to know by heart: your password manager, your computer login and your main email account. The words must be picked at random; a phrase you choose yourself is far weaker.
How this generator works
Every password is made on your device with crypto.getRandomValues, the browser's cryptographically secure random number generator. Math.random is never used. To turn random numbers into characters without bias, the generator uses rejection sampling: random values that would make some characters slightly more likely than others are thrown away and redrawn, so every character and every word is exactly equally likely.
When you select several character types, each password is guaranteed to include at least one of each, and the entropy figure accounts for that. The estimate assumes an attacker knows exactly which settings you used, which is the honest way to measure it. Nothing is sent to a server, saved or logged; you can even disconnect from the internet and the tool keeps working.
Keeping your accounts safe
A strong password is only one layer. Use a different password for every account and keep them in a reputable password manager, so you only need to remember one strong passphrase. Turn on multi-factor authentication wherever it is offered, preferably with an authenticator app, a hardware key or a passkey rather than text messages.
Current NIST guidance favors long passwords over complexity rules and advises against forcing people to change passwords on a schedule. Change a password when there is a reason to, such as a breach notification or a device you no longer trust. If you run a website, protect your own login pages too: rate limiting and brute-force protection stop attackers testing leaked passwords against your admin accounts.
