Strong passwords. Clear security.

Use the longest unique password the service accepts. NIST SP 800-63B-4 requires at least 15 characters when a password is the only authentication factor for the verifiers covered by that guidance. StrongPassword starts at 12 characters because that is your chosen product default; consider increasing it to 16 or more when the service allows it.

Not universally. Length and unpredictability are central. Some services impose composition rules, but current NIST guidance says verifiers should not impose character-composition rules. Use the character groups that the service accepts.

The generation code runs locally in your browser and does not send the generated value to our servers. This site does not write it to cookies, local storage, URLs or analytics. Copying it uses your browser’s clipboard interface.

A passphrase is a sequence of separate words. When the words are selected uniformly and independently from a sufficiently large list, a longer phrase can be easier to remember while still providing a large search space. StrongPassword selects words without repeating them in the same phrase.

The estimate uses the size of the random search space, assumes an average of half the space must be tried, and divides by the hypothetical guesses-per-second rate shown. It is not a prediction for a particular website or attacker.

No password can be promised to be impossible to guess or steal. Phishing, malware, reused credentials, weak account recovery and service breaches can bypass the strength of a password. Use unique passwords, multifactor authentication and secure devices.

Three alternatives let you choose a result that works with the service’s requirements and is comfortable to use. Only the option you copy needs to be used; the other two remain on the page until replaced or the page is closed.

Neither format is automatically safer. A phrase made from several uniformly selected words can offer a large search space and may be easier to remember. Its security depends on the list size, number of words and randomness of selection.

No. Use a different password or passphrase for every account. If one service is breached, unique credentials help prevent attackers from using the same value elsewhere.

Entropy describes the size of the set of possible values. In this tool it is an estimate based on generator settings and selection method; it is not a guarantee about how a real attacker will behave.

Change it on the affected service and anywhere else it was reused. Use a new unique value, enable multifactor authentication, review active sessions and check recovery methods. Follow the service’s official account-security guidance.

Copying is convenient, but the clipboard is managed by your operating system and may be accessible to other apps or device features. Copy only when needed, avoid shared devices and follow your device’s guidance for clearing clipboard history.

128 characters is the current product limit, not a universal standard. Some services accept less and others accept more. Check the service’s maximum length and character rules before using a generated value.