Generate strong, secure passwords with customisable options. Test any password's strength instantly.
A password strength checker analyses a password against the factors that actually determine how hard it is to crack: length, character variety (uppercase, lowercase, numbers, symbols), and whether it resembles a common or predictable pattern. This tool does both directions — generate a new cryptographically secure random password, or paste in an existing one to see its strength rating and estimated crack time.
Generated passwords use your browser's crypto.getRandomValues() API for true, cryptographically secure randomness — the same class of random number generator used in security-critical applications, and far stronger than the general-purpose Math.random() function.
| Type | Example | Crack Time (2026) | Rating |
|---|---|---|---|
| 8 char, lower only | password | Seconds | ❌ Very Weak |
| 8 char, mixed | P@ss1234 | Hours | ⚠️ Weak |
| 12 char, all types | X7@kL!p9qR2m | Years | ✅ Good |
| 16 char, all types | mK#9pQ2@vX!7wY4& | Centuries | ✅ Strong |
| Passphrase (4 words) | correct-horse-battery-staple | Centuries | ✅ Strong & Memorable |
| Who | Common Use |
|---|---|
| 🏢 Small business owners | Generate strong, unique passwords for business accounts and shared logins |
| 🔐 Anyone signing up for a new account | Generate a strong password instead of reusing an old one |
| 🧑💻 IT & support staff | Check whether a proposed password meets minimum strength requirements |
| 🎓 Students & new users | Understand what actually makes a password strong or weak |
| 🔍 Security-conscious users | Test an old, reused password to see how weak it really is |
How does this password generator work?
The generator uses crypto.getRandomValues() — the browser's cryptographically secure random number generator — to select characters from your chosen character set. This is the same API used by security-critical applications, far more secure than standard Math.random().
What is two-factor authentication (2FA)?
2FA requires two proofs of identity: your password plus a second factor (usually a one-time code from an authenticator app like Google Authenticator or Microsoft Authenticator, or an SMS code). Even if your password is stolen, 2FA prevents unauthorised login. The Australian Cyber Security Centre strongly recommends enabling 2FA on all important accounts.
How many character types should a password include?
Use all four character types (uppercase, lowercase, numbers, symbols) for maximum security. At 16 characters with all types, brute-force cracking would take centuries with current hardware. Avoiding ambiguous characters (0, O, l, 1) with the 'Exclude ambiguous' option makes passwords easier to type manually.
Should I use a password manager?
Yes — strongly recommended. Password managers (Bitwarden is free and open-source; 1Password is popular) generate, store, and autofill unique strong passwords for every site. You only need to remember one strong master password. This is far more secure than reusing passwords or writing them in notes.
What makes a password strong?
Length matters more than complexity: a 16+ character password using all four character types (uppercase, lowercase, numbers, symbols) is far stronger than an 8-character one with special characters crammed in. A long, random passphrase of unrelated words is both very strong and easier to remember than a short complex string.
How can I tell if my password has been compromised?
Check it against haveibeenpwned.com, which cross-references known data breaches without storing what you search. If a password shows up as compromised, change it immediately everywhere it's reused — that's also the strongest argument for never reusing passwords across sites.
What's a password strength checklist I can follow?
At minimum: 12+ characters (16+ for important accounts), a mix of uppercase, lowercase, numbers and symbols, no dictionary words or personal details, never reused across sites, and 2FA enabled wherever it's offered. This tool's strength bar checks most of these automatically as you type.
Is 8 characters long enough for a password?
Not for anything important. An 8-character password, even mixed case with numbers, can be cracked in hours with modern hardware. 12 characters is a reasonable minimum; 16+ with all character types is recommended for banking, email, and other high-value accounts.