How do I generate a strong password?
Reviewed by Prabath Thalangama · Last updated
Use a long, random password from a cryptographically secure generator and store it in a password manager. This generator builds passwords in your browser with crypto.getRandomValues, from 6 to 64 characters of letters, digits and symbols, and estimates strength in bits of entropy. Nothing is sent to a server.
Strength comes from length and randomness, not from clever substitutions. With all four character sets selected there are 88 possible characters, so each one adds about 6.5 bits: 16 characters give roughly 103 bits and the default 20 give about 129, far beyond any brute-force attack.
The symbol set is !@#$%^&*()_+-=[]{}|;:,.<>? and deliberately leaves out quotes, backslashes, slashes, backticks and spaces, which tend to break shell commands, config files and connection strings.
How do I use the password generator?
- Set the length. Use at least 16 characters, and 20 or more for root, admin and service accounts.
- Choose the character sets the target system allows. Turn on Exclude ambiguous if the password will be read aloud or typed from paper.
- Copy the password straight into your password manager or secret store.
How to read the results
- Password
- Each character is picked independently and uniformly from the selected sets. Because the picks are independent, a short password is not guaranteed to contain every selected type; generate again if a site insists on one of each.
- Strength
- Entropy = length × log2(character-set size). Under 40 bits is Weak, under 60 Fair, under 80 Strong, and 80 or more Very strong.
- Exclude ambiguous
- Removes I, l, 1, O and 0, which are easy to confuse in some fonts. This slightly shrinks the character set, so add a character or two to keep the same strength.
Common problems with generated passwords
The site rejects the password
Some sites cap the length or ban certain symbols. Lower the length or turn off symbols and make up the lost strength with extra length.
Password breaks a shell command or .env file
Quote the value. In a shell use single quotes; in .env files wrap it in double quotes if your loader supports it. Or generate a letters-and-digits password and add length.
export DB_PASSWORD='p@ss&w0rd|example'Examples and command-line equivalents
Generate a password on Linux or macOS
openssl rand -base64 24
LC_ALL=C tr -dc 'A-Za-z0-9!@#%^*_+=-' </dev/urandom | head -c 24; echoGenerate a password in PowerShell
Get-Random is fine for throwaway values; for secrets prefer [System.Security.Cryptography.RandomNumberGenerator].
-join ((33..126) | Get-Random -Count 24 | ForEach-Object {[char]$_})Frequently asked questions
How long should a password be?
At least 16 characters for accounts you care about, and 20 or more for administrator, root and service accounts. Length adds far more strength than extra symbol types.
Is it safe to use an online password generator?
It is when generation happens locally with a secure random source, as it does here. Avoid generators that create the password on a server. Store the result in a password manager rather than reusing it.
Are passphrases better than random passwords?
A passphrase of five or six random words from a large list is as strong as a 16-character random password and easier to type. Random characters are better for anything stored in a password manager, where nobody types it.