Password tips that hold up

Use at least 16 random characters for anything important. That's this site's default.

NIST SP 800-63B-4 requires at least 15 characters when a password is the only thing protecting an account, and at least 8 when it's paired with a second factor like an authenticator app. Longer is always better, and it matters far more than adding symbol types:

Average time to guess a randomly generated password at 100 billion guesses per second, using uppercase, lowercase, numbers, and common symbols. A human-chosen password of the same length falls much faster.

Not for strength, if the password is long and random. NIST now tells services not to force character-type rules, because people respond with predictable patterns like Password1!.

Many sites still demand one of each, so the generator guarantees every type you turn on appears at least once.

Yes. This is the single most important habit. When one site leaks, attackers automatically try the same email and password on banks, email, and shopping sites. A unique password for each account turns one breach into one problem instead of many.

Don't. Use a password manager, such as the one built into your phone or browser, or a dedicated app like Bitwarden or 1Password. It stores and fills random passwords for you.

You then remember just one strong passphrase to unlock it.

No. NIST says services shouldn't force regular changes, because people respond with small, guessable edits like Spring2026 to Summer2026. Change a password when there's a reason: it appeared in a breach, you shared it, or you suspect someone else knows it.

You can see whether one has leaked with the breach check.

Two-factor authentication (2FA) asks for something besides your password, like a code from an app on your phone. Even if your password leaks, an attacker can't sign in without that second step. Turn it on for email, banking, and anything with payment details.

Prefer an authenticator app, a security key, or a passkey over text-message codes, which can be intercepted.

Anything a person would think of, and therefore an attacker's software tries early:

• Names, birthdays, pets, teams, or anything findable on social media
• Dictionary words with swaps like P@ssw0rd; cracking tools try these automatically
• Keyboard patterns like qwerty or 1qaz2wsx
• The same password, or a small variation, used on more than one site
• Anything shorter than 12 characters

It's a fair question, and you shouldn't have to take our word for it. On this site:

• Passwords are made by code running in your browser. Open your browser's developer tools, go to the Network tab, and generate a few: no request is made.
• The site still works with your internet turned off once the page has loaded.
• There are no cookies, no ads, and no analytics or tracking scripts.
• The site sends a strict Content Security Policy, so the browser blocks scripts from anywhere else.

Only briefly. The "Download as .txt" option is meant for handing a batch of new passwords to yourself while setting up accounts. Move them into a password manager, then delete the file and empty the trash. A plain text file can be read by anyone or any malware with access to your computer.

Every estimate depends on how fast you assume the attacker is. We assume 100 billion guesses per second, a determined offline attack against a stolen database that uses a fast hash. Sites that assume slower attackers show bigger, more flattering numbers.

Our meter also measures how the password was made, not how it looks. That's accurate for passwords from this generator. For a password you made up, use the breach check, and assume it's weaker than it looks.