How to Create a Strong Password You Won't Regret

The quickest way to get a strong password is to let a generator pick it at random. Open ToolMany's Password Generator, keep the length at 16 characters or more with all four character types switched on, and press Copy next to one of the results. For a password you will type by hand, switch to Passphrase and use five or more random words.

The rest of this guide explains why randomness matters more than clever substitutions, how strength is measured, and how to keep generated passwords manageable.

What makes a password strong

Attackers rarely guess passwords one at a time on a login page. The real danger is a leak: a site is breached, its password database is copied, and the attacker tries billions of guesses per second offline against the stolen data. A password survives that only if it would take an impractically long time to guess.

Two things decide that time:

• Length. Every extra character multiplies the number of possibilities.
• Randomness. A password chosen by a person follows patterns, such as a word, a capital at the start and a year or "!" at the end. Guessing tools try those patterns first.

"Summer2026!" looks complex but is one of the first things a guessing tool tries. "q7Rv#Lm2xT9pBz4k" is not memorable, but there is no pattern to exploit.

Measuring strength in bits

Strength is usually expressed in bits of entropy. Each bit doubles the number of guesses needed on average. The generator shows the number for every setting:

The time estimate next to the strength bar assumes an attacker guessing ten billion times per second. It is a rough guide, not a promise, but the comparison between settings is what matters.

Note that the bits only apply when the password is truly random. A 16-character password made from your street name and birthday has far fewer real bits than the number of characters suggests.

Passwords vs passphrases

A passphrase is a password made of random words, such as Maple-Otter-Lunar-Crisp7. It is longer than a typical password but much easier to read, remember and type on a phone.

Use a random-character password when:

• a password manager will fill it for you, so you never type it,
• the site has a short maximum length.

Use a passphrase when:

• you need to type it, for example to unlock a laptop, a password manager or a Wi-Fi network,
• you need to read it out to someone.

For a passphrase to be strong, the words must be chosen at random by the generator, not picked by you. Use more words for anything important; seven random words is a sensible choice for the master password of a password manager.

Generating passwords safely

A password generator should never send your passwords anywhere. ToolMany's generator runs entirely in the browser tab and uses the Web Crypto API, the same random source browsers use for encryption. The values are picked without modulo bias, a subtle flaw where some characters come up slightly more often than others. Nothing is saved, so refreshing the page clears every password on the screen.

Copy the password straight into the sign-up form or into your password manager. Avoid pasting it into notes, chats or emails.

Practical settings

• Look-alike characters. Keep "Avoid look-alike characters" on if you might ever type the password from paper or another screen. It removes I, l, 1, O and 0.
• Symbols rejected? Some sites refuse certain symbols. Turn symbols off and add four or five characters of length instead; the strength stays high.
• Maximum length. If a site says the password is too long, lower the slider to its limit.
• Several at once. Generate 5 or 10 and pick one; they are all equally random.

Keeping track of strong passwords

Nobody can remember a different 20-character password for every account, and that is fine. A password manager stores them for you and fills them in. You only need to remember one strong passphrase to unlock it.

Use a different password for every account. If one site leaks it, the damage stops there. Switch on two-step verification wherever it is offered, especially for email, which can be used to reset everything else.

Passwords for files and Wi-Fi

The same rules apply outside websites. To protect a document, generate a password and lock the PDF with it, then send the password through a different channel than the file. For a home or office network, generate a passphrase and share it as a Wi-Fi QR code, so guests can join with one scan instead of typing it.