Your password generator should run in your browser. Here's how to check it.

Uros G — Thu, 29 Oct 2026 08:00:00 +0000

What Makes a Password Strong (A 5-Minute Guide)

Most of us learned the same password tricks. Put a capital letter at the start, swap "a" for "@", and finish with a number and an exclamation mark. They feel clever, but they're the first patterns a password-cracking tool tries.

Strong passwords come from two things: length and real randomness.

Why "Summer2026!" fails

"Summer2026!" has eleven characters, a capital letter, digits and a symbol. Plenty of sign-up forms would call it strong. The free strength checker at yourpasswordgenerator.com rates it "Very weak". It scores about 23 bits, with an estimated crack time of under a second. Crack times are rough estimates, since real speed depends on the attacker's hardware.

The problem is the pattern: a dictionary word, then a year, then a symbol. Attackers try those combinations in bulk.

Compare that with 16 characters picked at random from the 94 keyboard characters. That gives about 105 bits. Every extra bit doubles the number of guesses needed, so the gap is enormous.

What official guidance says now

The latest US guidance, NIST SP 800-63B Revision 4, sets a minimum of 15 characters for a password used on its own. The minimum drops to 8 when the password is one step of multi-factor sign-in. Services should accept at least 64 characters. They must not force character mixes or make you change passwords on a schedule.

Random password or passphrase?

Random password: use 16 or more random characters for every account your password manager fills in for you.

Passphrase: use six randomly chosen words for anything you have to type, such as your password manager's master password. Six words from the EFF wordlist give about 77 bits. The words must be picked at random, so a song lyric doesn't count.

What a good generator does

A password generator can make this easier by creating random passwords without relying on predictable patterns. Look for one that uses your browser's secure random number generator and doesn't send generated passwords to a server.