Generated on your device
Passwords are created in your browser with the Web Crypto API’s secure random number generator. They are never sent to a server or saved.
How long should a password be?
For most accounts, 16 characters or more with letters, numbers, and symbols is strong. Use a password manager so every account gets its own unique password.
About the strength estimate
Strength is measured in bits of entropy, based on the number of possible characters and the length. Each extra bit doubles the number of guesses needed, and 80 bits or more is very strong against guessing.
What current guidance says
The US National Institute of Standards and Technology (NIST), whose digital identity guidelines (SP 800-63B) are widely followed, favors length over complexity rules and no longer recommends forcing people to change passwords on a schedule. The most important things are that each password is long, random, and used for only one account, so a breach at one site can’t unlock your others.
Choosing the options
Keep all four character types on unless a site rejects symbols, and then make the password longer to compensate. “Avoid look-alikes” removes characters such as l, 1, O, and 0, which is helpful if you ever have to read the password aloud or type it from a printout. Store passwords in a password manager, which most browsers and phones now include, and turn on two-step verification for important accounts.