How to Create a Strong Random Password

What actually makes a password strong

The two factors that matter most are length and randomness. Neither clever substitutions (using @ for a or 3 for e) nor a mix of upper and lowercase letters compensates for a short or predictable password.

A 6-character password, even with symbols, is crackable in seconds with modern hardware. A 20-character random password from a broad character set would take longer than the age of the universe to brute-force.

Length

Password length is the single most important factor. Each additional character multiplies the number of possible passwords by the size of the character set.

With a 72-character set (uppercase, lowercase, digits, common symbols):

To illustrate the difference length makes, consider a hypothetical offline brute-force calculation running at a constant 10 billion guesses per second:

• 8-character uniformly random password (72^8): Exhaustively testing all 722 trillion possibilities would take approximately 20 hours. Assuming the password is generated uniformly at random, the expected time to discover it is approximately half that duration (~10 hours).
• 16-character uniformly random password (72^16): Testing through 522 octillion possibilities would take hundreds of billions of years — far exceeding the current age of the universe.

Note on real-world cracking speeds: This calculation is purely illustrative and assumes an attacker testing a single uniformly random password against a fast, unsalted hash without throttling. Real-world cracking time depends heavily on multiple practical variables:

• Hashing algorithm and work factor: Modern key-derivation functions (such as Argon2id, bcrypt, or scrypt) deliberately enforce computational and memory cost, reducing cracking throughput to dozens or hundreds of guesses per second rather than billions. Conversely, legacy fast hashes (like unsalted MD5 or SHA-256) permit high-speed parallel GPU attacks.
• Attack vector: Online login portals implement rate limiting, CAPTCHAs, and account lockouts that prevent rapid automated guessing. Offline brute-forcing occurs only when a compromised database hash has been extracted.
• Entropy and predictability: Real-world passwords often contain dictionary words, predictable digit suffixes, or keyboard sequences, shrinking the practical search space to a fraction of the theoretical total.

Recommendation: Use at least 16 characters for important accounts (banking, email, primary passwords). 12 characters is acceptable for lower-stakes accounts if you have many to manage.

Character variety

A larger character set means more possible passwords per character of length.

Mixing character types increases security, but length remains the dominant factor. A 20-character lowercase-only random password is stronger than an 8-character password with every character type.

Why predictable passwords are weak

Password crackers don't only try random guesses — they try known patterns first:

• Dictionary attacks — every word in every language, with common substitutions applied.
• Rule-based attacks — "password" → "P@ssw0rd", "p@55word", "Password1!" (all trivially cracked).
• Leaked password databases — billions of real passwords from past data breaches are freely available. If your password appears in any of them, it is already compromised.

Common patterns that feel strong but aren't:

• A word with some letters replaced by symbols (S3cur!ty)
• A word followed by numbers (dragon2024)
• Your name and birth year (alice1990)
• Keyboard patterns (qwerty, 123456, !QAZ2wsx)

These patterns are well-known and are among the first things crackers try.

True randomness

A password is only as unpredictable as the process that generated it. A password you think up yourself is influenced by your memory, habits, and the words and numbers meaningful to you — all of which reduce the actual search space a cracker has to cover.

A cryptographically random password generated by a tool has no such biases. Every character is chosen independently with equal probability from the allowed set. This makes the resulting password as hard to guess as the mathematics says it should be.

The Password Generator uses the browser's built-in crypto.getRandomValues() API for cryptographically secure randomness — the same standard used for cryptographic key generation.

Password managers

Generating strong random passwords is only useful if you can also remember or store them. For most people, using a different strong password for every account is only practical with a password manager.

A password manager:

• Stores all your passwords in an encrypted vault.
• Generates strong random passwords on demand.
• Fills them in automatically so you never have to type them.
• Means you only need to remember one strong master password.

Popular options include Bitwarden (open-source), 1Password, and Dashlane. Browser-built-in password managers (Chrome, Safari, Firefox) are better than nothing, though they are less flexible for cross-device use.

Avoiding password reuse

Using the same password on multiple sites means one breach exposes all of them. This is called credential stuffing — attackers take username/password pairs from one breach and automatically try them on other sites.

It is one of the most common attack vectors, and it is entirely preventable with unique passwords per site.

A note on security

No password is absolutely unbreakable. Security is about raising the cost of an attack beyond what is practical. A long, random, unique password protects against brute-force attacks, dictionary attacks, and credential stuffing. It does not protect against:

• Malware on your own device (a keylogger can capture what you type).
• A compromised server storing passwords incorrectly.
• Phishing (you entering your password on a fake site).

For important accounts, combine a strong password with multi-factor authentication (MFA) — even if your password is leaked, MFA requires a second factor that an attacker is unlikely to have.