How to Generate a Strong Password:
Step-by-Step Tutorial

This tutorial shows you how to generate a password that is actually strong — not "has a capital letter and an exclamation mark" strong, but resistant to billions of guesses per second. It takes about a minute, and the settings you choose matter more than the button you click.

Step 1: Open the Generator and Set the Length

Open the Password Generator. The first setting — length — is the one that matters most. Set it to at least 16 characters; 20 is better for anything important.

Here's why length beats complexity. Each added character multiplies the number of possible passwords by the alphabet size. Compare:

• 8 characters, all four character types (95-symbol alphabet): 95⁸ ≈ 6.6 × 10¹⁵ possibilities
• 16 characters, lowercase only (26-symbol alphabet): 26¹⁶ ≈ 4.4 × 10²² possibilities

The longer, simpler password has roughly 6.7 million times more possibilities than the shorter, complex one. A cracking rig testing 100 billion guesses per second exhausts the 8-character space in under a day; the 16-character space would take thousands of years. When a site's policy forces complexity, satisfy it — but get your security from length.

Step 2: Choose Character Sets

Enable uppercase, lowercase, digits, and symbols for maximum entropy per character. Two practical adjustments:

• Site rejects symbols? Some legacy systems only accept certain symbols or none. Disable the symbols set and add 4 characters of length instead — that more than compensates.
• Password must be typed by hand? For a Wi-Fi password you'll read off to guests or type on a TV remote, consider excluding look-alike characters (l, 1, I, O, 0) if the generator offers it, or use lowercase + digits only at greater length. Typing kX9#mQ2$vL8@ on a game controller is misery.

Step 3: Generate and Check the Strength

Click Generate. You'll get something like:

Vq7#tRk2$mXw9!pZ

Run it through the Password Strength Checker to see the estimated entropy and crack time. A good target is 80+ bits of entropy — a 16-character password from a 95-symbol alphabet gives about 105 bits, comfortably beyond any brute-force capability.

Generation happens locally in your browser using crypto.getRandomValues(), the cryptographically secure random source — the password never travels over the network. That's the property that makes a browser-based generator acceptable for real credentials.

Step 4: Store It — Don't Memorize It

A generated password is only practical with a password manager (1Password, Bitwarden, KeePassXC, or your browser's built-in manager). The workflow that actually works:

1. Generate the password.
2. Paste it into the site's signup/change-password form and into your password manager in the same minute.
3. Never reuse it anywhere else.

The one password you do memorize is your password manager's master password. For that, a generated 16-character string is hostile to memory; use a passphrase instead — four to six random words like brick-otter-plume-vivid-canyon. At ~12.9 bits per word from a 7,776-word list (the Diceware standard), five words give ~64 bits, and six give ~77 bits, while remaining typeable and memorable.

Generating Passwords Without the Tool

# macOS / Linux — 24 random Base64 characters
openssl rand -base64 24

# Linux — 20 chars from an explicit character set
tr -dc 'A-Za-z0-9!@#$%^&*' < /dev/urandom | head -c 20; echo

# Python 3
python3 -c "import secrets, string; print(''.join(secrets.choice(string.ascii_letters + string.digits + '!@#$%^&*') for _ in range(20)))"

Note the Python version uses the secrets module, not random — random is predictable and must never generate credentials. The same rule applies in every language: JavaScript's Math.random(), PHP's rand(), and C's rand() are all wrong for passwords.

Common Problems and Fixes

The site silently truncates long passwords

Some systems cut passwords at 16, 20, or 72 bytes (bcrypt's limit) without telling you — then the login fails because you typed the full version. If a fresh password immediately fails, try logging in with the first 16 or 20 characters. Long-term fix: check the site's stated maximum and generate exactly to it.

Password rejected for containing "invalid characters"

The site's form or backend can't handle certain symbols (often quotes, backslashes, or angle brackets — a smell of poor escaping on their end). Regenerate with symbols disabled and length increased. A 20-character alphanumeric password (~119 bits) is stronger than a 12-character anything.

"Password was found in a data breach" warning

Your browser or manager checks new passwords against breach corpora like Have I Been Pwned. A freshly generated 16-character random password will essentially never trigger this; if it does, you're likely reusing an old password instead of the generated one. Generate a new one and update the manager entry.

I need many passwords at once

Provisioning test accounts or seeding a user table? Generate in bulk with the CLI commands above in a loop, or click generate repeatedly and collect. For test fixtures where security doesn't matter, the Random String Generator does batches natively.

FAQ

How long should a password be in 2026?

16 characters minimum for accounts that matter (email, banking, cloud consoles), 20+ for anything protecting other credentials. Current NIST guidance (SP 800-63B) emphasizes length over composition rules and recommends supporting passwords up to at least 64 characters.

Are password generators safe to use?

A generator that runs client-side with a cryptographically secure random source is safe — verify by checking that the page works offline (disconnect Wi-Fi and generate; this tool does). Avoid any generator that produces the password on a server, because then the server saw your password.

Random password or passphrase — which is stronger?

Character-for-character, random strings pack more entropy. But strength comparisons only matter at equal memorability: for anything stored in a manager, use random strings; for the handful you must type from memory, a 5–6 word passphrase wins because you'll actually use it instead of writing it on a sticky note.

How is my password protected after I set it?

Properly built sites never store the password itself — they store a slow hash (bcrypt, scrypt, or Argon2) and compare hashes at login. That's why sites reset passwords rather than email you the old one. The password and hash guide explains how hashing, salting, and cracking economics work, and the Bcrypt Hash tool lets you see it in action.