Password for Steam
A Steam account with a game library and a linked card is a prime target. Here is a generator with suitable settings and what else to switch on.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
How accounts actually get stolen
Brute force is the rarest scenario. Practically every theft follows one of two paths.
Fake sites. A link to a “trade offer” or a “vote for our team” page leads somewhere indistinguishable from the real thing. The victim enters login, password and confirmation code, and all of it is relayed to the attacker in real time. Neither password length nor a second factor helps here: you hand over both yourself.
Reuse. The Steam password matches one from a forum that leaked three years ago. Checking that match costs almost nothing and is done automatically across millions of accounts.
What actually protects
Steam Guard through the app. Not by email: email gets stolen first. The app shows which action is being confirmed, and that is the last line of defence against fake sites — provided you read what you are approving.
A unique password. One service, one password. Sixteen random characters from a manager, and a leak from any forum stops concerning you.
Checking the address bar. Before typing a password, every time. The only reliable sign of a fake.
It is also worth checking your current password against breach databases.
Questions
Frequently asked questions
What are Steam’s password requirements?
At least eight characters, Latin letters, digits and punctuation. Service requirements change from time to time, so trust the sign-up form rather than articles. The practical advice is simple: take sixteen characters and any ruleset is satisfied with room to spare.
Is a password alone enough?
No. The main defence is Steam Guard, login confirmation through the app. Without it a strong password protects only against guessing, not against a fake trading site or malware.
How do accounts actually get stolen?
Not by brute force but by phishing and password reuse. Someone enters their details on a site that looks like a trade page, or reuses a password leaked from a forum years ago. A unique password plus login confirmation closes both.
Next