How to generate a strong password

July 18, 2026 · 5 min read

Most advice about "strong passwords" is stuck in the past — the old "at least one uppercase, one number, and one symbol" rule produces passwords that are hard for humans to remember and easy for computers to guess. Here's what actually makes a password strong, and how to generate one safely.

What makes a password hard to crack

Attackers don't sit there typing guesses — they run software that tries billions of combinations. What defeats that is entropy: the sheer number of possibilities they'd have to work through. Two things drive entropy:

Length — each extra character multiplies the number of combinations.
Unpredictability — the characters must be genuinely random, not a word or pattern.

Why length beats symbols

Adding one symbol to a short password barely helps; adding several characters helps enormously, because the possibilities grow exponentially with length. A long random passphrase can be far stronger than a short "P@ssw0rd!"-style string — and the classic complexity rules often just push people toward predictable tricks (a capital at the start, a 1! at the end) that attackers already expect. Aim for length and randomness first.

The rules that actually matter

Make it long — more characters is the single biggest win.
Make it random — don't base it on words, dates, or keyboard patterns.
Make it unique — never reuse a password across sites; one breach shouldn't unlock everything.
Store it in a password manager — you can't memorise dozens of random strings, and you shouldn't try.

Generate one without sending it anywhere

Here's a subtle risk: a password you generate on a website has, for a moment, existed on that website. If the generator runs on a server, your brand-new secret travelled over the network to get to you. The safe approach is a generator that runs entirely in your browser using the platform's cryptographically-secure randomness.

KeepItLocally's Password Generator does exactly that — it produces passwords locally with the browser's secure random source, so nothing is transmitted. Open DevTools → Network and you'll see it stay silent; it works offline, too.

Once you have a strong password, put it to use: encrypt a PDF so only the right people can open it. And if you're hashing values rather than storing secrets, use a local hash generator instead.