What makes a password strong
Strength is measured in entropy — the number of equally likely possibilities an attacker must try. Each character drawn from a pool of N possibilities adds log₂(N) bits:
Sixteen characters from the full 89-character pool is ~104 bits — far beyond any brute-force attack. Length beats complexity: adding 4 characters helps more than any symbol substitution, because entropy scales linearly with length but only logarithmically with pool size.
Time to crack, roughly
| Password | Entropy | Time to crack |
|---|---|---|
| 8 chars, lowercase only | ~38 bits | seconds |
| 8 chars, all types | ~52 bits | hours |
| 12 chars, all types | ~78 bits | centuries |
| 16 chars, all types | ~104 bits | billions of years |
| 20 chars, all types | ~130 bits | heat death of the universe |
Real attacks are usually smarter than brute force — they try leaked passwords, dictionary words, and predictable patterns (Name2024!) first. Random generation defeats exactly that: there is no pattern to exploit.
Rules worth following
- One site, one password. Reuse turns a single site's breach into a master key for your life. This is the number-one rule.
- Use a password manager. Random 16+ character passwords are unmemorizable by design — that's what managers are for. Then your one memorized password protects everything else.
- Turn on two-factor authentication for email, banking, and anything that can reset other accounts.
- Longer beats cleverer. If a site allows it, 20 characters of randomness is effectively unbreakable.
Frequently asked questions
Is it safe to generate a password on a website?
This one runs entirely in your browser using crypto.getRandomValues() — the page makes no network requests with your password, and you can verify by watching the network tab or loading the page offline. That said, the safest general habit is a reputable password manager's built-in generator.
How long should my password be?
Sixteen characters with mixed types (~104 bits) is a comfortable standard for anything important; twelve is a reasonable floor. Go to 20+ for password-manager master passwords and encryption keys.
Should I exclude ambiguous characters?
Only if you'll ever read and retype the password manually — Il1O0o are easy to confuse on paper or over the phone. If it lives in a password manager and gets autofilled, keep them for the extra entropy.
Are passphrases like 'correct horse battery staple' better?
They trade length for memorability: four random common words carry ~44–52 bits — decent, and far better than human-invented passwords. For accounts a manager fills automatically, random character strings at 16+ characters are stronger per keystroke.
How often should I change my passwords?
Modern guidance (including NIST's) says: don't rotate on a schedule — change a password when there's a reason: a breach notification, a shared device, or suspicion of compromise. Scheduled forced changes push people toward weaker, patterned passwords.