In this article
What Makes a Strong Password?
A strong password is one that takes an attacker an unreasonably long time to crack, even with modern computing hardware. The two most important factors are length and randomness. A 20-character random password is astronomically stronger than a clever 8-character password with substitutions.
Brute-force attacks try every possible combination. For an 8-character password using uppercase, lowercase, digits, and symbols (about 90 characters), there are 90^8 = 430 billion combinations. Modern GPUs can test billions of hashes per second, making 8-character passwords vulnerable. At 16 characters, the same character set has 90^16 combinations — effectively uncrackable with current technology.
How Password Generation Works
The generator uses cryptographically secure random number generation to produce passwords with the specified characteristics.
- CSPRNG — uses the browser's crypto.getRandomValues() for true cryptographic randomness
- Character set selection — configure which character types to include: lowercase, uppercase, digits, symbols
- Exclusions — optionally exclude ambiguous characters like 0/O or 1/l/I that are easily confused
Try it free — no signup required
Generate a Password →When To Use a Password Generator
A password generator should be used any time you need a new password for an account or service.
- New accounts — generate a unique random password for every new online account
- Password rotation — replace old or reused passwords with fresh random passwords
- Service accounts — generate complex passwords for database users, API keys, and system accounts
Frequently Asked Questions
How long should a password be?
At minimum, 12 characters for non-critical accounts and 16-20 characters for sensitive accounts. NIST recommends a minimum of 8 characters for user-set passwords but 15+ for machine-generated passwords. Since you will store it in a password manager, length has no practical usability cost — always go longer.
Is it safe to use an online password generator?
CheckTown's password generator runs entirely in your browser using JavaScript's crypto.getRandomValues(). No passwords are transmitted to any server. You can verify this by observing your browser's network activity. The generated passwords never leave your device.
What is a passphrase and is it better than a random password?
A passphrase is a sequence of random words (correct-horse-battery-staple). Long passphrases are both strong and memorizable. A 4-word passphrase from a 7776-word dictionary has 7776^4 = 3.6 trillion combinations, comparable to a 10-character random password. For accounts you need to type manually, a passphrase is often more practical.