How to create a strong password
- Choose Password or Passphrase. A new one is generated straight away.
- Adjust the length or number of words. The strength estimate updates as you go.
- Press Copy and paste it into the sign-up form or your password manager.
- Press Generate new as many times as you like. Nothing is saved.
Why random beats clever
People are predictable. Attackers use lists of common passwords and patterns like a word followed by a year and a symbol, such as Summer2024!, so these are guessed quickly even though they look complex. A password chosen at random has no pattern to exploit: the only way to find it is to try every possibility.
Use a different password for every account, so that one data breach does not unlock everything else. A password manager makes this practical: it remembers the passwords, and you only need one strong passphrase to unlock it.
How the strength estimate works
Strength is measured in bits of entropy: each extra bit doubles the number of guesses needed. The estimate assumes the worst case, where an attacker knows exactly how the password was generated, including the character set or word list. The time shown is the average time to guess it at 100 billion guesses per second, a well-resourced offline attack on a leaked database that used a fast, unsalted hash. Sites that hash passwords properly make guessing millions of times slower.
| Rating | Entropy | Suitable for |
|---|---|---|
| Very weak / weak | under 50 bits | Nothing important |
| Fair | 50–69 bits | Low-value accounts with rate limiting |
| Strong | 70–99 bits | Most accounts, including email and banking |
| Very strong | 100 bits or more | Password manager master passwords, encryption keys |
How passwords are generated
- Random values come from your browser’s cryptographically secure generator, using rejection sampling so that no character or word is slightly more likely than another. With At least one of each type on, one character from each chosen type is guaranteed, so characters from small sets such as digits turn up a little more often. The strength shown accounts for this.
- Passphrases use the EFF Large Wordlist, 7,776 common, easy-to-type words chosen by the Electronic Frontier Foundation for memorability, used under theCC BY 3.0 US licence.
Frequently asked questions
Are these passwords stored or sent anywhere?
No. Passwords are generated in your browser using its cryptographically secure random number generator (crypto.getRandomValues). They are never sent to NiftyKit, never logged and never stored. Reloading the page shows a new one.
Password or passphrase: which should I use?
Both are strong when they are long and random. Use a password for accounts saved in a password manager, where you never type it. Use a passphrase for the few things you must remember or type by hand, such as your password manager’s master password or your computer login. Six random words are about as strong as a 12-character random password and much easier to remember.
Is a passphrase of dictionary words not easy to guess?
Not when the words are chosen at random. The strength estimate assumes the attacker knows the exact word list and the number of words. With 7,776 words, each one adds about 12.9 bits, so six words give 77.5 bits: over 200 sextillion possibilities. What makes passphrases weak is choosing the words yourself, for example a song lyric or a phrase about you.
How long should my password be?
For a random password with all character types, 16 characters or more is a good default, and 20 is better if the site allows it. For important accounts aim for at least 70 bits of entropy, shown as “strong”. Every extra character makes a password much harder to guess, so length matters more than adding symbols.