Strong Password Generator

The anatomy of a strong password

A strong password has three properties, in this order of importance:

It is long. Each extra character multiplies the number of possibilities by the size of the character set. Going from 12 to 20 characters makes a password roughly 6 quadrillion times harder to brute-force.
It is random. No dictionary words, names, dates, keyboard walks (qwerty, 1qaz2wsx) or predictable substitutions (P@ssw0rd).
It is unique. Used for exactly one account, so a leak somewhere else cannot unlock it.

Complexity rules (“one uppercase, one number, one symbol”) help only a little. They are why so many people end up with Welcome1!. A long random string satisfies those rules automatically — this generator always includes at least one character of each selected type.

How strong is “strong enough”?

Attackers who steal a database of password hashes can test guesses offline at enormous speed. A single modern GPU can try more than 100 billion MD5 or NTLM hashes per second. That is the scenario to plan for:

Average brute-force time at 100 billion guesses per second
Password (all 94 characters)	Entropy	Average time at 10¹¹ guesses/sec
8 characters	52 bits	about 8 hours
10 characters	66 bits	about 9 years
12 characters	79 bits	about 80,000 years
16 characters	105 bits	about 400 times the age of the universe
20 characters	131 bits	effectively never

We default to 20 characters because it leaves a huge safety margin for future hardware, and it costs you nothing when a password manager does the remembering.

When a website limits your password

Some older sites cap length at 12 or 16 characters or forbid certain symbols. In that case use the maximum length they allow, keep all permitted character types, and make sure that account has two-factor authentication. If a site rejects specific symbols such as quotes or backslashes, use the alphanumeric generator and add a few characters to compensate.

Strong passwords are only half the job

Even a perfect password can be phished or stolen by malware. Pair it with multi-factor authentication, keep your devices updated, and check passwords you already use with the password strength checker — it runs offline, too.

Last updated: November 7, 2026 · Reviewed by the Password Generator team

Frequently asked questions

What is an example of a strong password?

Something like c7#Vq!2mR@x9Lp$e4Tz& — 20 random characters with no words or patterns. Do not copy an example from any website; generate your own so that nobody else has ever seen it.

Is 12 characters strong enough?

A truly random 12-character password with all character types has about 79 bits of entropy, which resists offline brute force for tens of thousands of years at today’s speeds. For important accounts, NIST now recommends 15 or more characters.

Are strong passwords hard to remember?

Random ones are, which is why you should store them in a password manager. For the few passwords you must memorise, use a passphrase of 5–6 random words instead.

Does adding a symbol at the end make a password strong?

Not by itself. Attackers expect the “word + number + symbol” pattern. Strength comes from length and randomness across the whole password.