Create a strong password on your device
Published · Updated 2 min read
The strength of a password comes from two things: its length, and the randomness with which it is produced. A password you invent yourself, even a complicated one, almost always follows habits, and the programs that try to guess passwords know those habits. A password drawn at random has none.
What the tool does
It generates a password of 8 to 64 characters, with uppercase letters, lowercase letters, digits and 26 symbols as you choose. It uses your browser's random generator, designed for this purpose, and the password is created on your device: it is sent nowhere.
Length matters most
The tool estimates strength in bits, a unit that measures the number of possible combinations: each extra bit doubles the work needed to guess. With 8 characters you get about 52 bits, rated "Fair". With 16 characters you reach about 103 bits, "Very strong". With 24 characters you reach about 155 bits. Each added character brings about 6.5 bits, so making a password longer protects far more than replacing a letter with a symbol.
Choose the character families
Each family you tick appears at least once in the password, which satisfies sites that require an uppercase letter, a digit or a symbol. If a site rejects some symbols, or if you must type the password by hand on a phone, you can untick the symbols and make up for it with a few more characters.
What makes a password weak
A dictionary word, a first name, a birth date, a run of keys such as "qwerty" or the same password reused on several sites are the first attempts of any guessing program. The worst case is reuse: if a single site is hacked, all your other accounts are exposed.
Keep it
A password of 20 random characters cannot be memorized, and that is not the point. Keep it in a password manager, which will fill it in for you, and never in a message, an email or a note open to everyone.
For which accounts
For any online account, but above all email, banking and the accounts that let you reset the others: a long, unique, randomly drawn password, kept in a manager.
Check before adopting
Try the password once when you open the account to make sure the site accepts it in full, then generate a new, different one for each site.
Frequently asked questions
- How long should a password be?
- At least 16 characters for an important account. The tool estimates about 103 bits for 16 characters, rated "Very strong", and about 155 bits for 24.
- Is the generated password sent anywhere?
- No. It is created on your device, with the browser's random generator, and is sent nowhere.
- Should you use symbols?
- They increase strength, but length matters more. If a site rejects some symbols, untick them and add a few characters.
- Where should you keep a 20-character password?
- In a password manager, which fills it in for you. Avoid messages, emails and notes open to everyone.