What Makes a Password Strong
Password strength is not about looking complicated. It is about entropy — the number of equally likely possibilities an attacker must search. Entropy depends on two things only: how large the pool of symbols is, and how many are chosen at random.
Entropy (bits) = length × log2(pool size)
A 12-character password from the 94 printable ASCII characters has 12 × log2(94) ≈ 78.7 bits, meaning about 278.7 possibilities. Every extra bit doubles the work required to break it.
Critically, this only holds when the characters are chosen randomly. "P@ssw0rd123!" has twelve characters from a large pool, but it is not random — it is a dictionary word with predictable substitutions, and cracking tools try exactly those patterns first. Its real entropy is closer to 20 bits than 78.
Time to Crack by Length and Character Set
Assuming an offline attack at 100 billion guesses per second, realistic for a modern GPU cluster against a poorly hashed password:
| Character set | 8 chars | 10 chars | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|---|
| lowercase only (26) | 1 s | 706 s | 6 days | 7K yrs | 3B yrs |
| lowercase + digits (36) | 14 s | 18,281 s | 274 days | 1M yrs | 1012 yrs |
| upper + lower + digits (62) | 1,092 s | 49 days | 511 yrs | 8B yrs | 1017 yrs |
| all printable ASCII (94) | 30,478 s | 9 yrs | 75K yrs | 1013 yrs | 1021 yrs |
Read across a row and the effect of length is dramatic; read down a column and the effect of the character set is real but much smaller. Length beats complexity. Adding four characters does more than adding symbols.
Passphrases
A passphrase made of random words trades a smaller pool for far greater length, and is much easier to remember and type. With the 564-word list used here:
| Words | Entropy | Rating |
|---|---|---|
| 3 | 27.4 bits | Weak |
| 4 | 36.6 bits | Weak |
| 5 | 45.7 bits | Weak |
| 6 | 54.8 bits | Weak |
| 7 | 64.0 bits | Reasonable |
| 8 | 73.1 bits | Reasonable |
| 11 | 100.5 bits | Very strong |
The crucial word is random. A memorable phrase you invented yourself — a song lyric, a quotation, a sentence about your dog — carries almost no entropy, because human word choice is highly predictable and attackers use phrase dictionaries. Words drawn by a generator, in an order no one chose, are what makes the method work.
Larger public word lists such as the EFF's 7,776-word Diceware list give 12.9 bits per word rather than the 9.1 bits here, so six words reach 77 bits. Either way, add words rather than adding punctuation.
Entropy Ratings
| Entropy | Rating | Adequate for |
|---|---|---|
| under 40 bits | Very weak | Nothing — crackable in seconds |
| 40–60 bits | Weak | Low-value accounts with rate limiting |
| 60–80 bits | Reasonable | Most online accounts |
| 80–100 bits | Strong | Email, financial accounts, password manager |
| over 100 bits | Very strong | Encryption keys, master passwords |
What Actually Compromises Accounts
Brute-force cracking is rarely how accounts are lost. In practice the causes are:
- Reuse after a breach. A password leaked from one site is tried everywhere else. This is by far the most common route, and no amount of password strength protects against it.
- Phishing. The password is handed over voluntarily to a convincing fake page. Strength is irrelevant.
- Credential stuffing. Automated replay of leaked username and password pairs across thousands of sites.
- Malware and keyloggers. Capture at the keyboard, before any encryption applies.
- Weak recovery flows. Security questions whose answers sit on a public social media profile.
The practical conclusion: a unique password per site matters more than an extremely strong one, and two-factor authentication matters more than either.
Practical Advice
- Use a password manager. It is the only realistic way to have a unique strong password for every account. Its master password should be a long passphrase.
- Turn on two-factor authentication wherever offered. An authenticator app or hardware key is considerably stronger than SMS, which is vulnerable to SIM swapping.
- Do not rotate passwords on a schedule. NIST withdrew that advice in 2017 — forced rotation pushes people toward predictable variations. Change a password when there is a reason to.
- Treat security questions as passwords. Store random answers in your manager rather than truthful ones.
- Check for exposure. Services such as Have I Been Pwned reveal whether an address appears in known breaches.
Privacy of This Tool
Every password is generated by crypto.getRandomValues in your own browser. There is no network request, no logging and no storage — closing the page destroys the result. That said, the safest passwords are the ones your password manager generates directly, since they never appear on a screen at all.
Frequently Asked Questions
Are these passwords unique?
Effectively yes. A 16-character password from the full ASCII set has around 1031 possibilities — a collision is not a practical concern.
Why exclude ambiguous characters?
Because l, 1, I, O and 0 are easily confused when a password is read aloud, written down or typed from a screen. Excluding them costs about 0.3 bits per character, negligible next to the reduction in typing errors.
Should every site have a different password?
Yes, without exception. Reuse converts one site's breach into a breach of everything.
Is a passphrase weaker than a random string?
Not necessarily — it depends on the word count and list size. To match a 16-character random password you would need around 11 words from this list, or 7–8 from a larger Diceware list. Passphrases win on memorability, not on entropy per character.