Password generator — strong random passwords explained

What makes a password strong — length beats complexity

A password's strength is really one number: how many guesses an attacker needs. "P@ssw0rd1!" ticks every complexity checkbox — uppercase, symbol, digit — yet falls fast, because attackers don't guess blindly. They run dictionaries of leaked passwords plus mangling rules that try exactly those tricks: capitalize the first letter, swap a for @, append a year and an exclamation mark.

What those rules cannot shortcut is genuine randomness plus length. Every extra random character multiplies the number of possible passwords by the size of the character set, so a 16-character random string is astronomically harder to crack than a 10-character "clever" one. That is the whole case for a password generator: it removes the human patterns that cracking tools are built to exploit.

• Weak habits attackers try first: a word plus a year, letter-for-symbol swaps, keyboard walks like qwerty123.
• Strong: random characters, drawn independently, 16 or more of them.
• Unique per account — strength cannot save a password that leaked from another site.

Is an online password generator safe?

It depends entirely on where the password is generated. If a site creates your password on its server, that password crossed the internet and touched someone else's machine before you ever used it. That is the version of this question worth worrying about.

Carbide's password generator takes the other approach: the page loads once, then every password is generated locally in your browser by the Web Crypto API — the same cryptographically secure random source password managers use. Nothing you generate, copy or type is transmitted; there is no account and no analytics tied to your passwords. You can verify this yourself: open your browser's network tab, generate a hundred passwords, and watch no requests leave. Once the page has loaded it even keeps working with the connection switched off.

How to generate a strong password in seconds

The whole job takes about ten seconds:

• Open the password generator.
• Set the length to 16 characters or more — this is the setting that matters most.
• Keep all four character sets on (uppercase, lowercase, digits, symbols); only turn symbols off if a site rejects them.
• Generate, and check the strength meter reads at the top of the scale — regenerate freely until you like the result.
• Copy it in one tap, paste it into the sign-up form, and store it somewhere safe like Secure Notes.

How long should a password be in 2026?

Sixteen characters is the sensible floor for anything you care about. The math is simple: a random character drawn from uppercase, lowercase, digits and symbols carries roughly 6.5 bits of entropy, so 8 characters give about 50 bits, 12 about 78, and 16 lands past 100 bits — beyond any realistic brute-force attack.

Why the caution? When a service is breached, attackers usually get password hashes, and modern GPU rigs test billions of guesses per second against them offline (see how hashes work). A 50-bit password can fall to that kind of attack; a 100-bit one cannot. Since a generated password is pasted rather than typed, extra length costs you nothing — there is no reason to stop at 8 or 10 characters just because a site's minimum allows it.

• 8 random characters ≈ 50 bits — crackable offline, avoid.
• 12 random characters ≈ 78 bits — acceptable for low-value accounts.
• 16+ random characters ≈ 100+ bits — the 2026 default for email, banking and anything that resets other accounts.

Passwords vs passphrases — when to use which

A passphrase is a chain of randomly chosen words — the famous "correct horse battery staple" pattern. Each word picked at random from a large wordlist adds about 13 bits of entropy, so six words reach roughly 78 bits while staying easy to type and possible to remember. That makes passphrases the right choice for the handful of secrets you must enter by hand: your computer login, your Wi-Fi key, the master password protecting everything else.

For the other hundred-plus accounts in your life, random generator output wins. You never type those passwords — you paste them — so memorability is irrelevant and a 20-character random string is both stronger and shorter than an equivalent passphrase. The practical split: memorize one or two strong passphrases, generate everything else, and store it safely. The strong password guide walks through building that setup step by step.

No password-manager upsell — how the free generators differ

Search for a password generator and nearly every result is a teaser owned by a paid password manager — a nudge toward a subscription. There is nothing wrong with those tools, but the generator itself should not be bait. Carbide's is simply a free tool: no account, no trial, full control over length and character sets, generated on your device.

It also sits next to the rest of a free security toolkit. Store what you generate in Secure Notes — PIN-locked, encrypted on your device, covered in the notes guide. Developers get a hash generator and a UUID generator (more in the generators roundup) on the same principle: everything computed in your browser. And the coming-soon Carbide app adds a sandboxed private browser and an app lock — both covered in the phone privacy post.

Frequently asked questions