How to Generate a Strong Random Password

Humans are bad at randomness. We reuse structures: name + year, keyboard walks, movie quotes, and the same base password with a site suffix. Cracking tools try those structures first. A generator that samples from a full character set (or a full word list) removes that bias.

What “random” must mean

Cryptographic randomness (CSPRNG) is the standard for secrets. Browser generators should use crypto.getRandomValues or equivalent, not Math.random(). If a tool cannot say how entropy is sourced, treat it as a toy.

• Generate unique passwords per account
• Store them in a password manager
• Score edge cases with a local strength checker
• Never reuse a generated password across banks, email, and social

Start with the password generator for a candidate, then open the password strength checker to see how length and character mix move the estimate. Prefer tools that keep the secret in your browser.

Length multiplies the search space. For randomly generated passwords, each extra character is a full factor of the alphabet size — far more effective than swapping one letter for a symbol on a short string.

Practical targets

• 12–16 characters — minimum many sites accept; fine for random manager passwords if the alphabet is wide
• 16–24 characters — comfortable default for important accounts when the site allows it
• 32+ characters — excellent when APIs or service accounts allow long secrets
• Site caps — if a form maxes out at 12 or 16, use full randomness and every allowed class; uniqueness still matters

Some legacy systems silently truncate. After generation, paste once, save in the manager, and confirm login with the full string. If login fails, the site may be cutting length or rejecting certain symbols.

The generator on Generatr supports a range suitable for everyday accounts (including lengths from short experiments up through much stronger options). Push length up until the site complains, not down to what you can memorize — memorization is the manager’s job.

For the theory behind length and bits, read how password strength and entropy work.

Entropy estimates unpredictability. For a fully random password of length L drawn uniformly from N symbols, entropy is about L × log₂(N) bits. Larger N and larger L both help. Humans who pick “random-looking” strings usually fall short of that formula.

Common sets

• Lowercase — N = 26
• Lower + upper — N = 52
• Alphanumeric — N = 62
• Printable ASCII with symbols — often ~90–95

Toggling symbols helps more when the password is already reasonably long. A short password with every class checked can still be weak if the generator is biased or the length is tiny. A long lowercase random string can beat a short mixed one.

Site rules versus real strength

Policies that require “one upper, one number, one symbol” are filters, not full threat models. Meet the policy so signup works, but size strength primarily with length and true randomness. Avoid generators that always put ! at the end — predictable structure shrinks real entropy.

After you generate, paste into the password strength checker and compare a 12-character mixed password to a 20-character one. Length usually wins the comparison in a clean way.

Both can be strong. They solve different usability problems.

Random character passwords

Best for stored credentials: email, banks, shopping, work apps. You never type them daily if the manager autofills. Maximize length and allowed character set. Generate with the password generator, save once, move on.

Passphrases

A passphrase is several random words from a large list (diceware-style), optionally with separators or a digit. Easier to type on a TV, friend’s console, or master-password prompt. Strength comes from word-list size and word count, not from a single dictionary word with leetspeak.

• Use random passwords for almost every website account
• Use a long passphrase for password manager unlock, disk encryption, or rare manual entry
• Avoid famous quotes — they appear on cracking lists

UUIDs and API keys are related ideas (high-entropy identifiers) but they are not logins. See the UUID guide when you need IDs, not human account secrets. Encoding a weak password in Base64 does not strengthen it — Base64 is not encryption.

Generation without storage discipline fails the moment you reuse a sticky note across five sites. A password manager is the default answer for individuals and teams.

Do

• Save each generated password in a reputable manager immediately
• Enable multi-factor authentication on the manager and on critical accounts
• Use unique secrets for email and banking first — those reset everything else
• Prefer client-side generation so the secret is not POSTed to a random server

Don’t

• Email passwords to yourself or drop them in shared docs
• Reuse one “strong” generated string everywhere
• Screenshot passwords into unencrypted camera rolls
• Type your manager master password into online generators or strength sites

Browser-based tools are convenient for learning and one-off needs. For highest assurance, generate inside the manager app itself so the secret never touches a web page. When you do use a web generator, confirm over HTTPS, avoid untrusted clones, and clear the clipboard after paste if you share a machine.

Score practice strings with the password strength checker; keep real master secrets offline from experimental tools.

A repeatable workflow beats ad-hoc invention when a site forces a reset.

1. Open the account’s password change form and note length limits and required character classes.
2. Open the password generator and match those constraints (length, upper, lower, numbers, symbols).
3. Generate until you get a candidate that meets policy without obvious patterns.
4. Optionally paste into the password strength checker for a second opinion — client-side only.
5. Copy once into the site and into your password manager entry for that domain.
6. Confirm login in a fresh session or private window.
7. Remove the password from the clipboard when you are done on shared devices.

If the site rejects the password, read the error: illegal character, max length, or “too similar to previous” are different fixes. Do not weaken into Password1! patterns to satisfy a vague form.

For service accounts and automation, prefer long random secrets or keys designed for machines, rotated on a schedule, and stored in a secrets vault — not in source control.

Bad folklore wastes effort and sometimes weakens outcomes.

• “Complexity always beats length” — for random passwords, both matter; for humans, length and uniqueness dominate theatrical symbols
• “Change every 30 days” — forced rotation of strong unique passwords often creates seasonal variants; rotate after breach or shared exposure instead
• “Security questions are fine as passwords” — answers are often public or guessable; use random answers stored in the manager if the site forces them
• “Encoding hides the password” — Base64 and URL encoding reverse easily; they are not protection
• “One strong password is enough” — one leak then becomes many without uniqueness

MFA still matters when phishing or session theft bypasses the password. Generation improves the secret; it does not replace device security or account recovery hygiene.

Generate with the free password generator, verify with the strength checker, and keep the broader strength model handy via the password strength guide.