Length beats complexity
A password's resistance to guessing comes from how many possibilities an attacker must work through, and length raises that count far faster than complexity does. Each additional character multiplies the search space by the size of the alphabet; swapping an "a" for an "@" merely adds one option to one position.
This is why "P@ssw0rd!" is weak and a 20-character random string of plain letters is not. The first is a dictionary word with predictable substitutions that every cracking tool tries first; the second has no structure to exploit.
Practically: prefer 16 characters or more, and when a site imposes a low cap, use every character it allows.
What the strength rating means
The Weak / Medium / Strong label here is a quick heuristic based on the password's length and the mix of character types it contains. It is a sanity check, not a formal entropy calculation, and it cannot tell whether a password has been exposed in a breach.
Because it inspects the generated string rather than your settings, two passwords made with identical options can occasionally land on different labels — if a short one happens to contain no digit, for instance. Increase the length and the rating stops wavering.
Storing passwords safely
Generating a strong password is the easy half. Where it lives afterwards is what usually fails.
- Use a password manager. It is the only realistic way to have a different strong password for every account. Browser-built-in managers are far better than reuse.
- Never reuse a password. Credential-stuffing attacks take one breached password and try it everywhere. Reuse is what turns one company's breach into your problem.
- Turn on two-factor authentication wherever it is offered, especially on email — whoever controls your inbox can reset everything else.
- Protect the manager itself with a long passphrase you can remember and have never used anywhere else.
- Do not email or message passwords. Those copies persist in places you no longer control.
- Change a password when a service reports a breach, not on an arbitrary schedule — forced rotation mostly produces predictable variations.
Random strings and passphrases
A random string is the right shape for anything a manager will type for you. A passphrase — several unrelated words chosen at random — is easier for a human to memorise and can be just as strong given enough words, which makes it the better choice for the handful of passwords you must type from memory: your device login and your password manager's master password.
This tool generates random strings only; it does not have a passphrase mode.