How strong is strong?
Strength is measured in bits of entropy: how many guesses an attacker needs. Every extra bit doubles the work. Roughly: below 50 bits is weak, 60–70 bits is good for most accounts, 80+ bits is strong even against an attacker with a lot of computers who stole a password database.
A passphrase of random words is easier to remember and type than random characters of the same strength. This generator uses a list of 651 everyday English words, so each word adds about 9.3 bits. The words are chosen by the computer, not by you – people are very bad at being random.
And quantum computers?
A quantum computer does not break passwords the way it would break public-key encryption (RSA and elliptic curves, used in HTTPS and SSH – that is Shor's algorithm). For guessing passwords it could only use Grover's algorithm, which in theory halves the strength in bits: a 72-bit passphrase would be about as hard as a 36-bit one today. In practice it is much less dramatic – Grover's algorithm cannot be split across thousands of machines like today's password cracking, every quantum step is slow, and good websites store passwords with deliberately slow functions. As far as is publicly known, no quantum computer today can do any of this.
So: for website passwords, 70–80 bits is still plenty. For secrets that must stay safe for decades – the master password of a password manager, the password of an encrypted backup or disk – aim for about 128 bits: a passphrase of 13–14 words, or 20+ random characters from all groups. The real quantum threat is to encrypted traffic recorded today and decrypted years later, which is why new "post-quantum" encryption standards (ML-KEM, ML-DSA, published by NIST in 2024) are now being built into browsers and SSH.
The best place for passwords is a password manager such as KeePassXC or Bitwarden: one strong passphrase you remember, a different random password for every site. Why that works is in How Encryption Works.