Random password or three random words?
Both are strong if they're long enough. They suit different jobs:
- Random passwords like
q7#Vm2!xTe9@Lp4zare best when a password manager remembers them for you. 16 random characters are, in practice, impossible to guess or crack. - Passphrases made of random words, like
Walnut-Comet-Harbour-Tango, are best for passwords you have to type or remember yourself, such as your computer login, your email or your password manager's main password. The UK's National Cyber Security Centre (NCSC) recommends using three random words. Our word list is shorter than a full dictionary, so this generator always uses at least four.
The words must be chosen at random, not picked by you. Phrases people choose themselves, like song lyrics or a pet's name plus a year, are much easier to guess.
How strong is strong?
The strength shown is in "bits", a measure of how many guesses an attacker would need. Each extra bit doubles the number of guesses.
| Bits | Rating | Example |
|---|---|---|
| Under 36 | Weak | 6 lower case letters, or a single word with numbers |
| 36 to 55 | Good | Four random words from our list with a number and symbol |
| 56 to 75 | Strong | Six random words with a number and symbol, or 12 mixed characters |
| 76 or more | Very strong | 16 mixed characters |
Length beats complexity. Adding one more random word or a few more characters does more than swapping letters for symbols, like "p@ssw0rd", which attackers try automatically.
Is it safe to use an online password generator?
This one is. The passwords are created by your own browser using its secure random number source, the same type used for encryption. Nothing is sent to us, saved or logged, and you can even disconnect from the internet after the page loads and it will still work.
Good password habits
- Use a different password for every account. When one website is hacked, criminals try the same email and password on other sites. A password manager makes this easy.
- Protect your email first. Your email can reset every other password, so give it a strong passphrase and turn on two-step verification.
- Turn on two-step verification (2SV) wherever it's offered, especially for banking, email and social media.
- Don't change passwords for the sake of it. The NCSC says regular forced changes make people choose weaker passwords. Change one if you think it's been exposed.
- Check if you've been in a data breach using a trusted service such as Have I Been Pwned, and change any password that appears.
Frequently asked questions
What is a strong password?
A long, random one. A random 16-character password with letters, numbers and symbols, or a passphrase of three or four random words, is very hard to crack.
What does the NCSC recommend for passwords?
The National Cyber Security Centre recommends using three random words, a different password for every account, a password manager and two-step verification.
Is this password generator safe?
Yes. Passwords are created in your browser using a secure random source and are never sent to us or stored.
How long should a password be?
At least 12 characters, and 16 or more for important accounts. For a passphrase, use at least four random words, or three from a very large word list.
Should I use the same password on more than one site?
No. If one site is hacked, criminals will try that password on your other accounts. Use a different password for each, ideally with a password manager.
Last reviewed October 2026. Passwords are made in your browser using a secure random source and are never sent or stored.