Secure Random Password Generator

How to generate a strong password — 3 steps

1. 1

   Set the length

   Length is the single most important setting. Sixteen characters is a sound minimum for an ordinary account, and more for anything that matters.

2. 2

   Choose the character types

   Include upper and lower case, digits, and symbols unless the site forbids them. Some services reject certain symbols, which is worth checking before you save one.

3. 3

   Store it somewhere you trust

   A generated password is only useful if you can retrieve it. Put it straight into a password manager rather than trying to remember it.

Length beats complexity, and randomness beats cleverness

The strength of a password is how many possibilities an attacker would have to work through, and length raises that number far faster than complexity does. Each additional character multiplies the search space by the size of the character set, so adding one character to a long password does more than adding a symbol to a short one. A twelve-character random password is enormously stronger than an eight-character one, whatever mix of symbols the shorter one contains.

This is why the familiar advice about substitutions is close to worthless. Turning 'password' into 'P@ssw0rd!' satisfies most complexity meters and resists essentially nothing, because password-cracking tools have applied those substitutions automatically for decades. The same is true of a memorable word with a number and an exclamation mark on the end — a pattern so common it is among the first things tried.

Randomness is what actually helps, and it is the part humans are worst at. People asked to invent a random password produce predictable structures: a capital at the front, a digit or two at the back, a real word in the middle, symbols from the top row of the keyboard. Generated passwords have no such structure, which is precisely their value. If you need something you will type by hand rather than paste, several unrelated random words strung together give real length with far less typing pain than a random string.

The habit that matters more than the password itself

Reuse is the failure that causes actual harm. Breaches happen constantly, and when a service is compromised the stolen credentials are tried automatically against banks, email providers, and shopping sites — an attack that works only because the same password was used in more than one place. A password of any strength used across several accounts converts one company's security failure into a compromise of all of them.

Email deserves particular protection, because it is the master key to everything else. Anyone with access to your inbox can trigger password resets on every account tied to it, so an email password should be unique, long, and paired with two-factor authentication. The same reasoning applies to your password manager, your phone account, and anything financial.

Two-factor authentication is worth more than any improvement to a password, because it means a stolen password alone is not enough. Turn it on wherever it is offered, preferring an authenticator app over SMS where there is a choice. And ignore the old advice about changing passwords every ninety days — routine rotation pushes people towards small predictable variations, and current guidance is to keep a strong unique password and change it when there is a reason to, such as a breach notification.

Related tools