---
title: "How to generate a strong random password | ToolSugar"
description: "Generate a random password of the length you choose, pick the character sets, and read the entropy estimate to judge how strong it is."
canonical: https://toolsugar.com/blog/how-to-make-a-strong-password
image: https://toolsugar.com/og.png
---

# How to generate a strong random password

Updated 2026-11-09

To generate a strong random password, pick a long length and let a secure random source choose every character. Password Generator does this in your browser with the crypto API, then shows an entropy estimate in bits. The password is made on your device and is never sent or stored. Length matters more than anything else you set.

[Open Password Generator](https://toolsugar.com/tools/password-generator)

## Generate a password in four steps

Decide where the password will be used, because some sites reject certain symbols or cap the length.

1. Set the Length between 4 and 128.
2. Switch on the character sets you want: lowercase, uppercase, digits and symbols.
3. Press Generate for a new password.
4. Press Copy and read the entropy line.

## How long should a password be

Each extra character multiplies the number of possible passwords. A 20 character password with all four sets is far harder to guess than a 10 character one, even if the short one looks messier.

Use a long password for anything you store in a password manager, since you never type it. Shorten it only when a site forces a limit. A passphrase of random words is easier to type, but this tool builds character strings, so use it for values you paste. Write nothing down on paper unless you store it somewhere safe.

## Read the entropy number

Entropy in bits is the length times the base-2 logarithm of the pool size. The pool is the count of characters you allowed. Each added bit doubles the guesses an attacker needs.

The figure is an upper bound. It assumes every character was picked at random. That is nearly true here, because the tool also makes sure each switched-on set appears at least once. The figure says nothing about a password you changed by hand afterward.

## Why randomness quality matters

A password built from Math.random can be predictable. This tool calls crypto.getRandomValues and uses rejection sampling. It throws away values that would favor some characters, so every character in the pool is equally likely.

## Fit a site with odd rules

If a site refuses symbols, switch that set off and raise the length to make up the lost entropy. If you need a numeric code, switch off the other three sets. Never reuse the result on a second account. After you copy a password, paste it straight into your password manager or the sign-up form. Do not send it by chat or email. If you regenerate by mistake, the previous one is gone, because nothing is saved, so copy before you press Generate again.

## Questions

### Is an online password generator safe to use?

Only if it runs on your device. This one makes the password in your browser and does not send or save it. Close the tab when you are done.

### Should I add symbols or just make it longer?

Length adds more strength per character. Add symbols when a site requires them, and add length whenever it allows.

### How many bits of entropy are enough?

There is no single answer. Higher is stronger, and a long password from all four sets gives a large number. Use the figure to compare options.

[Open Password Generator](https://toolsugar.com/tools/password-generator)

## Related guides

- [How to generate UUIDs in bulk (v4 and v7)](https://toolsugar.com/blog/how-to-generate-a-uuid)
- [How to encode and decode Base64 online](https://toolsugar.com/blog/how-to-encode-and-decode-base64)
- [How to count tokens in a prompt before sending it](https://toolsugar.com/blog/how-to-count-tokens-for-ai-models)