What makes a password strong
Password strength comes down to entropy — how many possible combinations an attacker would have to try. Length matters more than clever substitutions: a longer random password is far harder to crack than a shorter one with symbols swapped in for letters. The strength meter above estimates this in "bits" — the higher the number, the longer a brute-force attack would take.
Password security best practices
- Use a different password for every account, so one leaked password doesn't compromise the rest
- Store passwords in a reputable password manager instead of memorizing or reusing them
- Turn on two-factor authentication wherever it's offered, as a backup if a password is ever compromised
- Change a password immediately if a service you use reports a data breach
Frequently asked questions
Are generated passwords stored anywhere?
No — each password is generated locally in your browser using the Web Crypto API and is never sent anywhere or saved. Closing or refreshing the page discards it.
How long should my password be?
Most security guidance now recommends at least 12–16 characters for important accounts; longer is better as long as the site accepts it.