How to Create a Strong Password

Memorable phrases like “P@ssw0rd1” fail because they are common patterns. Strength comes from length plus unpredictability. A 16-character mix of upper, lower, digits and symbols, drawn with a cryptographic RNG, is a solid default on this site.

How the generator works

1. Set length and which character classes you need (some sites ban symbols).
2. Generate. Each selected class contributes at least one character, then the rest are drawn from the combined set and shuffled.
3. Copy into a password manager. Closing the tab discards it.

Indexes are picked with crypto.getRandomValues and rejection sampling so a naive modulo does not bias the last characters of the alphabet.

The strength checker

Estimated entropy ≈ length × log2(charset size), plus simple pattern and common-password flags. “password” scores as known-weak even if you padded it. That is a local hint, not a guarantee nobody can guess it.

Reuse is still the usual failure. One unique password per account, stored in a manager, beats a clever password you recycle.