By the TriPass team · Published 11 October 2026 · General security information, not a guarantee about any product.
A strong password is long, random and used for one account only. Let a generator pick it: 16 or more random characters for passwords a password manager fills in, or six or more random words for a passphrase you need to remember. NIST’s current guidance sets 15 characters as the minimum for a password used on its own.
What makes a password strong?
Three things: length, randomness and using it for one account only. A password is strong when an attacker who tries guesses in the most efficient order still needs an impractical number of attempts. Human-made passwords fall early because people choose from the same patterns: words, names, dates, keyboard runs and predictable swaps like P@ssw0rd.
The current US guidance, NIST SP 800-63B-4, reflects this. A password used on its own should be at least 15 characters. Services should allow at least 64 characters, should not force mixtures of character types, should not force regular changes, and should check new passwords against lists of known-compromised ones.
How this generator works
Each character (or word) is picked by crypto.getRandomValues, the cryptographically secure random number generator built into your browser. A raw random number can’t be mapped onto, say, 76 characters without making some slightly more likely than others (modulo bias), so numbers that would cause that are thrown away and drawn again. Every character is then equally likely.
Random passwords use up to 76 characters: 26 uppercase, 26 lowercase, 10 digits and 14 symbols (!@#$%^&*-_=+?~). If you tick a type, the generator makes sure at least one character of that type appears, because many sites demand it. Passphrases are words picked from the EFF Long Wordlist, which has 7,776 words chosen to be easy to read and type.
All of it runs in this page. There is no server call, no logging and no storage, which you can check by loading the page, going offline and generating again.
How strong is a random password?
Strength is measured in bits of entropy: each bit doubles the number of possible passwords an attacker has to search. For a password picked at random, it is simple arithmetic: length × log2(number of possible characters), or words × log2(7,776) for a passphrase.
| Password | Entropy |
|---|---|
| 12 random characters | 75 bits |
| 16 random characters | 100 bits |
| 20 random characters | 125 bits |
| 24 random characters | 150 bits |
| 5 random words | 65 bits |
| 6 random words | 78 bits |
| 7 random words | 90 bits |
| 8 random words | 103 bits |
To put 80 bits in perspective: even at a trillion guesses a second, working through half of 280 possibilities would take about 19,000 years. Real attack speed depends on how a website stored the password, so treat that as an illustration, not a promise. These figures only apply to randomly generated passwords; they say nothing about a password you made up.
Random password or passphrase?
Use a random password for anything a password manager fills in for you. You never type it, so it can be long and unreadable.
Use a passphrase for the few things you must remember and type: your password manager’s master password, your computer login, your phone’s account. Six or more random words are far easier to remember than an equally strong string of symbols. The words must be chosen at random (by a generator or dice), not picked by you, and not a phrase from a song, film or book.
Common mistakes that make passwords weak
- Reusing a password. When one site is breached, attackers try the same email and password everywhere else (credential stuffing). A unique password per site contains the damage.
- Predictable substitutions. Swapping letters for symbols (
a→@,o→0) is the first thing cracking tools try. - Personal details. Names, birthdays, pets, teams and suburbs are easy to find or guess.
- Patterns and padding.
Summer2026!follows the most common pattern there is: a word, a year, a symbol. - Short but complicated. An 8-character password with symbols is weaker than a 16-character one without them.
After you generate a password
Save it in a password manager straight away, so you never need to remember or reuse it, and turn on two-factor authentication for important accounts. A strong password doesn’t help if it is phished, and a second factor limits the damage when that happens. How 2FA codes work explains the options, and How password managers work explains what to look for in one.
The TriPass app for iPhone has its own generator built in. This page is a separate, free tool and works whether or not you use TriPass.