How to generate a strong password

July 18, 2026 · 5 min read

Most advice about "strong passwords" is stuck in the past — the old "at least one uppercase, one number, and one symbol" rule produces passwords that are hard for humans to remember and easy for computers to guess. Here's what actually makes a password strong, and how to generate one safely.

What makes a password hard to crack

Attackers don't sit there typing guesses — they run software that tries billions of combinations. What defeats that is entropy: the sheer number of possibilities they'd have to work through. Two things drive entropy:

Length — each extra character multiplies the number of combinations.
Unpredictability — the characters must be genuinely random, not a word or pattern.

Why length beats symbols

Adding one symbol to a short password barely helps; adding several characters helps enormously, because the possibilities grow exponentially with length. A long random passphrase can be far stronger than a short "P@ssw0rd!"-style string — and the classic complexity rules often just push people toward predictable tricks (a capital at the start, a 1! at the end) that attackers already expect. Aim for length and randomness first.

The rules that actually matter

Make it long — more characters is the single biggest win.
Make it random — don't base it on words, dates, or keyboard patterns.
Make it unique — never reuse a password across sites; one breach shouldn't unlock everything.
Store it in a password manager — you can't memorise dozens of random strings, and you shouldn't try.

Generate one without sending it anywhere

Here's a subtle risk: a password you generate on a website has, for a moment, existed on that website. If the generator runs on a server, your brand-new secret travelled over the network to get to you. The safe approach is a generator that runs entirely in your browser using the platform's cryptographically-secure randomness.

KeepItLocally's Password Generator does exactly that — it produces passwords locally with the browser's secure random source, so nothing is transmitted. Open DevTools → Network and you'll see it stay silent; it works offline, too.

What "cryptographic" means here, and why offline matters

A cryptographic password generator draws from a CSPRNG — in the browser, crypto.getRandomValues(), the same source that seeds your TLS connections — not from Math.random(), which is fast, predictable, and never intended for secrets. An attacker who learns a few outputs of a non-cryptographic generator can often predict the rest, which turns a "random" password into a guessable one.

Running that generator offline closes the remaining gap. A password generated on a remote server was known to that server, appeared in its memory, and may have passed through logs or a proxy before reaching you. A password generated in your own tab never existed anywhere else. You can pull the network cable and keep generating — the page is a progressive web app and needs no connection after the first load, so an offline password generator here is simply the normal mode of operation.

Once you have a strong password, put it to use: encrypt a PDF so only the right people can open it. And if you're hashing values rather than storing secrets, use a local hash generator instead.