How do I generate a strong random password?
Open FixDoks's Password Generator and a strong 16 character password is ready instantly. Adjust the length and choose uppercase, lowercase, numbers and symbols, or tick Avoid look-alike characters for one you can type by hand. It uses your browser's cryptographic random generator, and you can create up to 500 at once.
Password Generator at a glance
| Randomness | Browser's cryptographic random generator (crypto.getRandomValues) |
|---|---|
| Batch limit | Up to 500 passwords at once |
| Processing | In your browser; your files are not uploaded |
| Price | Free |
| Works on | Chrome, Edge, Safari and Firefox on Windows, Mac, Android and iPhone |
How to use Strong Password Generator
- A strong 16 character password is ready as soon as the page loads.
- Change the length and choose uppercase, lowercase, numbers and symbols.
- Tick Avoid look-alike characters if you will type it by hand.
- Click Copy, or set How many to create a batch and download them.
Why do random passwords matter?
Most accounts that get broken into use passwords people invented themselves: a name plus a birth year, a cricket team, "Password@123". Attackers try these patterns first, along with passwords leaked from other sites. A password made of truly random characters has no pattern to guess, so the only way in is to try every combination, which becomes impossible once the password is long enough.
How this generator works
FixDoks uses your browser's cryptographic random number generator (crypto.getRandomValues), the same source browsers use for encryption keys. It avoids a subtle mistake called modulo bias, so every character in the pool is exactly equally likely. When you tick several character types, the password is guaranteed to contain at least one of each, which keeps sites with "must contain a number and a symbol" rules happy. Passwords are created on your device and are never sent anywhere.
What the strength meter means
Strength is shown in bits of entropy: the length multiplied by log2 of the number of possible characters. Each extra bit doubles the number of guesses needed. The time estimate assumes an attacker making 10 billion guesses per second offline, which is realistic for a fast graphics card attacking a poorly protected leaked password database.
| Password type | Entropy | Verdict |
|---|---|---|
| 8 lowercase letters | about 38 bits | Weak |
| 10 characters, all types | about 64 bits | Strong |
| 16 characters, all types | about 103 bits | Very strong |
| 20 characters, all types | about 129 bits | Very strong |
The estimate only applies to passwords generated randomly like this. A human-made password of the same length is far weaker because it follows patterns.
Choosing a length
- 16 characters or more for email, banking, UPI apps and your password manager's other entries.
- 20 or more for anything that protects other accounts, such as your main email.
- If a site limits length or symbols, use the longest it allows and untick symbols if they are rejected.
Keeping passwords safe
Use a different password for every account, so one leak does not unlock the rest. Nobody can remember dozens of random passwords, so store them in a password manager, such as the one built into your browser or phone, or a dedicated app. Turn on two-factor authentication for email and banking. Never share an OTP or password with anyone who calls or messages you, even if they claim to be from your bank. For the one password you must remember (your password manager's master password), a long phrase of several random words is easier to type and still strong.