How to Generate a Strong Password (And What 'Strong' Actually Means)

"Use a strong password" is easy advice to give and surprisingly easy to get wrong in practice — not because people don't try, but because "strong" is a specific, measurable property that a password you make up yourself is bad at achieving, and because not every password generator is actually generating randomness that's safe to rely on.

Why Math.random() Isn't Good Enough

Here's the detail that matters and rarely gets mentioned: JavaScript's Math.random() is a general-purpose random number function, not a cryptographically secure one. In some JavaScript engines, its internal state can theoretically be inferred from enough outputs, which matters for anything actually used as a credential. The right tool for generating a password is the Web Crypto API's crypto.getRandomValues() — a cryptographically secure random source built into every modern browser specifically for cases like this. QR Ivify's Password Generator uses that, not Math.random().

What "Entropy" Actually Measures

The tool shows an entropy estimate in bits alongside every generated password. This number answers a specific question: given the character set and length you chose, how many possible passwords could this generator have produced? More bits means more possible outputs, which means more attempts a brute-force guess would need on average. As a rough guide:

• Under 40 bits — weak. Crackable in a realistic timeframe with dedicated hardware.
• 40–60 bits — fair. Adequate for low-stakes accounts, not ideal for anything important.
• 60–80 bits — strong. Solid for most personal accounts.
• 80+ bits — very strong. Comfortable margin for anything sensitive.

Both length and character variety increase entropy — a longer password with fewer character types can have similar or better entropy than a shorter one with more types, since length compounds multiplicatively.

Step by Step

1. Open the Password Generator.
2. Choose a length and which character types to include — uppercase, lowercase, numbers, symbols.
3. Optionally exclude ambiguous characters (I, l, 1, O, 0) if you'll need to type or read it manually.
4. Click "Generate" — entropy is shown alongside the result.
5. Copy it to use.

Generated Safely Doesn't Mean Stored Safely

Worth saying plainly: this tool generates the password entirely on your device and never transmits it anywhere — but a strong password only stays strong if where you put it afterward is also secure. A password manager, not a plain text file or a sticky note, is what actually protects a generated password over time.

Frequently Asked Questions

Is this actually random, or just Math.random()? It uses the Web Crypto API (crypto.getRandomValues), a cryptographically secure random number generator — the same class of randomness used for real security purposes, not the weaker Math.random().

What does the entropy number mean? It's the estimated strength in bits, based on your character set and length — roughly, how many attempts a brute-force guess would need. Higher is stronger; 60+ bits is generally considered strong for most purposes.

Should I exclude ambiguous characters? Only if you'll need to type or read the password manually — turning it on avoids confusing characters like 1/l/I or 0/O.

Does this upload or store my generated password anywhere? No. It's generated entirely in your browser and never leaves your device.

Is there a maximum length? Up to 64 characters, comfortably more than any realistic password policy requires.

Try It

Need a genuinely strong, random password? QR Ivify's free Password Generator uses real cryptographic randomness with a visible strength estimate. Just need a random string, not specifically a password? The same tool covers that too — turn off symbols for something easier to type.