On this page
Length beats symbolsWhich setting for which accountThings that matter more than the generatorMost advice about passwords makes them harder for you to type and barely harder for attackers to guess. What matters is how many guesses it would take, and that depends mostly on length. Here is how to pick settings in the Password Generator that are strong and still practical.
Length beats symbols
Each extra character multiplies the work for an attacker. The numbers show the effect clearly:
| Password | Characters it draws from | Strength |
|---|---|---|
| 12 characters, all types | 94 | about 79 bits |
| 16 characters, lowercase and digits | 36 | about 83 bits |
| 20 characters, lowercase only | 26 | about 94 bits |
A longer password made only of letters and digits is stronger than a shorter one stuffed with symbols, and much easier to type correctly.
Which setting for which account
Accounts in a password manager
You never type these, so use everything: 20 or more characters with all types selected. Copy it straight into the manager.
Passwords you must type by hand
Wi-Fi, a TV, a games console, a shared computer. Pick a length of 16 to 20, keep lowercase and digits, switch off symbols, and turn on Avoid look-alikes so you never have to tell a capital O from a zero, or an l from a 1.
A master password
This one you must remember. Generate a long one, then write it down once and keep it somewhere safe at home until it is second nature.
Things that matter more than the generator
- Never reuse a password. One leak should not open every account.
- Turn on two-step verification for email, banking and anything that can reset other accounts.
- Use a password manager. It is the only realistic way to have a different strong password everywhere.
The generator runs in your browser: nothing is sent or stored, and the password disappears when you close the page.
Password GeneratorFree · runs in your browser · nothing is storedOpen tool