Create a Strong Password and Check Its Strength (Free Tools)

Creating a password and checking a password are two jobs. The generator exists because humans pick patterns. The checker exists because those patterns still look "complex" to a website's rules. Using only one of them is how you end up with a unique, random 20-character secret you never test, or a checked password that is just Summer2026! with a passing grade from a naive meter.

Do both, in this order, in the browser so the secret never hits a server.

Step 1: generate something you would not invent

Open the Password Generator. Set length to 16 or more (20 for email and banking). Enable every character class the site allows. Generate. Do not edit the result to make it memorable. That edit is how A!b2C# happens.

If the site forbids symbols, keep the length and drop symbols. Four extra letters beat one exclamation mark. Store it in a password manager immediately. A random password you cannot retrieve is a locked account.

The generator already has a long-form guide: free random password generator. This article is the combined habit, not a second copy of that page.

Step 2: check it (or check an old one you still use)

Open the Password Strength Checker and paste. You want length and randomness, not a dictionary word with substitutions. The checker explains why a "complex" short password still fails. Nothing is transmitted as you type.

Use the checker on passwords you already have, not only on fresh generated ones. The uncomfortable results are the reused mailbox password and the patterned laptop login.

What "strong" is not

• Meeting a site's uppercase / number / symbol rules. That is a minimum, and cracking tools try those substitutions first.
• One strong password reused everywhere. The next breach of the weakest site hands the attacker the rest.
• A UUID, pet name, or keyboard walk. Unique is not the same as unguessable.

Then turn on 2FA

A strong unique password plus an authenticator app (not SMS if you can avoid it) is the practical setup. The password manager holds the random strings. You memorise the manager's passphrase, which you can build with a passphrase generator if you need something rememberable.

Frequently asked questions

Should I generate or check first?

Generate first for new accounts. Check first when you are auditing something you already typed for years.

Are these tools safe in a browser?

These two run locally. Do not use a generator that produces passwords on a server you do not control.

How long should the password be?

At least 16 characters, 20+ for accounts that can reset everything else (email).

Generate in the Password Generator, then confirm in the Strength Checker. Both free, no signup.