How-to Guides Security

How to Generate Strong Passwords and Passphrases

Choose between a random password and a passphrase, pick a length from the entropy numbers, store it in a password manager and add a second factor.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

Steps

  1. Decide what the secret is for

    If a password manager will fill it in, use a long random password. If you must memorise it, as with the manager's master password or a device login, use a passphrase.

  2. Generate a random password

    Open the Password Generator, set the length to at least 16 and tick all four character sets. That gives a pool of 92 characters and about 104 bits of entropy. Use at least 20 for the most important accounts.

  3. Or generate a passphrase

    In the Diceware Passphrase Generator pick a separator and a word count. This tool's list has 359 words, about 8.5 bits per word, so the default of 6 words is only about 50.9 bits: choose 8 words (67.9 bits) or more for anything that matters.

  4. Audit what you already use

    Type an existing password into the Password Strength & Entropy Auditor to see its entropy, pattern warnings and crack-time estimates. If it looks weak, replace it. Never type a password you still use into a tool you do not trust.

  5. Store it in a password manager

    Save each password in a reputable manager so it is unique to one site. Reusing a password lets one breach unlock your other accounts.

  6. Add a second factor

    Turn on app-based two-factor codes wherever it is offered. You can see how the six-digit codes are derived, or test one against a secret, with the TOTP Generator; never paste the real secret of an account you care about into any web page.

What you need

A password manager (or a plan to adopt one) and the list of accounts that matter most: email, banking, the manager itself and anything that can reset other passwords.

How much entropy is enough

Entropy in bits is length × log₂(pool size). Each extra bit doubles the number of guesses an attacker needs. The tools use the same arithmetic, and the generator reports the result live.

Length Lowercase only (26) Letters + digits (62) All four sets (92)
8 38 48 52
12 56 71 78
16 75 95 104
20 94 119 130

A common target for important accounts is at least 80 bits, which a 16-character password using all four sets clears comfortably. Lowercase-only passwords need far more characters to reach the same level.

Passphrase strength by word count

Passphrase entropy is the word count × log₂(list size). With this tool's 359-word list that is 8.49 bits per word:

Words Entropy (bits)
4 34.0
5 42.4
6 50.9
8 67.9
10 84.9

A standard 7,776-word Diceware list gives about 12.9 bits per word, so six words from that list reach about 77.5 bits. A shorter list needs more words for the same strength, which is why the word count matters more than the separator.

Common pitfalls

  • Reusing a password. Credential stuffing tries leaked passwords on other sites. Make every one unique.
  • Building a password from personal details. Names, birthdays and pet names are guessed first.
  • Trusting a clever pattern. A word with symbols swapped in is still a predictable pattern.
  • Storing passwords in a notes file or browser without a master secret. Use a manager with a strong passphrase.
  • Skipping the second factor. A strong password does not help if it is phished; two-factor adds a second barrier.

Going further

How stored passwords are protected on the server side is compared in MD5 vs SHA-256 vs bcrypt, and the codes behind two-factor apps are explained in How Two-Factor Codes (TOTP) Work.

Try these tools

Password Generator

Generate high-entropy, secure passwords instantly with our free online tool.

Diceware Passphrase Generator

Generate a random, memorable multi-word passphrase from a curated word list using cryptographically secure randomness.

Password Strength & Entropy Auditor

Audit password strength entirely in your browser with live entropy-bit calculation, crack-time estimates across hardware scales.

TOTP Generator

Generate time-based one-time passwords (TOTP, RFC 6238) from a Base32 secret with a live countdown.

See also

  • Comparison MD5 vs SHA-256 vs bcrypt
    MD5 is broken, SHA-256 is the fast general-purpose hash, and bcrypt is a deliberately slow password hash.
  • Guide How Hashing Works
    What a hash function does, the avalanche effect shown with real SHA-256 output, which algorithms are still safe, HMAC.
  • Glossary Entropy
    In security, entropy measures how unpredictable something is, such as a password or key, usually expressed in bits.
  • Glossary Multi-factor authentication (MFA)
    Multi-factor authentication (MFA) requires two or more kinds of proof to sign in.
  • Glossary Brute-force attack
    A brute-force attack tries every possible password or key, or a huge list of likely ones, until one works.
  • Glossary Passphrase
    A passphrase is a password made of several randomly chosen words.
  • Glossary bcrypt
    bcrypt is a deliberately slow password-hashing function that adds a random salt and a tunable cost factor.

Frequently Asked Questions

Both are strong when generated randomly. A random password packs more entropy into fewer characters and suits anything a password manager fills in. A passphrase of random words is easier to remember and type, which suits the few secrets you must know by heart, such as the master password of the manager itself.

No. The Password Generator and Diceware Passphrase Generator use your browser's secure random number generator and run entirely on your device.

Predictable substitutions such as a to @ add almost nothing because attackers try them first. Randomness and length are what count.

Back to the how-to guides
AdSense Placeholder
Slot: footer_leaderboard