Most account breaches don’t come from someone “cracking” a strong password — they come from reused, short or leaked ones. Here’s what actually makes a password strong, and a realistic way to manage them.
The password is random; the strength is arithmetic you can check. Our password generator defaults to length 16 with upper, lower and digits — a pool of 62 characters. Entropy is length × log₂(pool), so 16 × log₂(62) ≈ 95 bits, which the tool labels “Strong”. The thresholds are fixed in the code: under 45 bits weak, under 75 fair, above that strong. Two implications: adding symbols raises the pool to 87 and buys only about 8 more bits, while adding four characters of length buys roughly 24.
Length beats complexity
The strength of a random password comes from its entropy — roughly, how many possibilities an attacker must try. Entropy grows with length far faster than with fancy character rules. A 20-character password is dramatically harder to brute-force than an 8-character one, even if the shorter one has !@#$.
Forced complexity rules (“must contain an uppercase and a symbol”) often backfire: they push people toward predictable patterns like Password1!. Prefer long and random over short and gimmicky. A password generator gives you long, high-entropy strings instantly.
Our own generator makes the arithmetic visible. At its defaults — length 16, upper plus lower plus digits, a pool of 62 characters — the entropy is length × log₂(pool), so 16 × log₂(62) ≈ 95 bits, which it labels “Strong”. Now compare the two ways to improve that: turning on symbols raises the pool to 87 and buys about 8 bits, while adding four characters of length buys roughly 24. Length wins, and the numbers say by how much.
That claim is arithmetic, and our own password generator shows its working. At the page defaults — length 16, letters and digits only — the character pool is 62 and the strength readout is Strong, because 16 × log2(62) is about 95 bits. Turn on the symbol set as well and the pool becomes 87: our symbol list holds 25 distinct characters, so 26 + 26 + 10 + 25. Adding symbols to a 16-character password buys about five bits; adding four more characters buys about twenty. That is the whole argument for length in one comparison.
Passphrases: strong and memorable
For the few passwords you must actually type from memory (your device login, your password-manager master password), a passphrase of four or more random words is both strong and memorable — far better than a short “complex” string. The key word is random: pick words you didn’t choose for meaning.
The two rules that matter most
- Never reuse passwords. If one site is breached, attackers try that email/password pair everywhere else (called credential stuffing). A unique password per site contains the damage.
- Use a password manager. You can’t remember 100 unique 20-character passwords — and you shouldn’t try. A manager generates, stores and autofills them. You only remember one strong master passphrase.
Add two-factor authentication (2FA)
Even a perfect password can be phished or leaked. 2FA adds a second step — an authenticator app code or a hardware key — so a stolen password alone isn’t enough. Turn it on for email, banking and anything important. App-based or hardware 2FA is stronger than SMS.
Quick checklist
- Long (16+ characters) and random for site logins → use a generator.
- A memorable random passphrase for your master password.
- Unique per site, stored in a password manager.
- 2FA on important accounts.
- Never store passwords in plain-text notes, spreadsheets or chats.
Generate a strong, random password right now with the free password generator — it uses your browser’s cryptographic randomness and never uploads or stores anything.
A checklist is only useful if you can check it, so here is the one number to check. Our password generator reports Strong at length 16 with a pool of 62 and about 95 bits. Turn every character class on and the pool reaches 87 (26 + 26 + 10 + 25 symbols). If a generator will not tell you its pool size, you cannot verify its strength claim — and “Strong” with no pool behind it is a colour, not a measurement.
Entropy at a glance
Entropy is measured in bits — each extra bit doubles the guesses an attacker needs. These figures assume every character or word is picked uniformly at random; a human-chosen “clever” password has far less.
| Password | Composition | Approx. entropy |
|---|---|---|
| 8 characters | upper + lower + digits | ~48 bits |
| 12 characters | + symbols (95-char set) | ~79 bits |
| 16 characters | + symbols (95-char set) | ~105 bits |
| 4 random words | from a 7,776-word list | ~52 bits |
| 6 random words | from a 7,776-word list | ~78 bits |
Below ~50 bits is weak; 75+ bits comfortably resists offline cracking of a properly hashed password. A six-word passphrase (~78 bits) rivals a 12-character symbol soup while being far easier to type.
The thresholds are not opinion either — they are fixed in the tool: under 45 bits it says weak, under 75 fair, above that strong. That is why the default 16-character setting lands at 95 bits and reads “Strong” without needing symbols at all.
One caveat about that 95-bit figure, because it is the number people quote wrongly: it is the entropy of the generator, not of the password. It assumes every character was drawn independently and uniformly, which is true for our output and false for anything you thought of yourself. A human-chosen 16-character password built from two dictionary words and a year has perhaps 30 bits, not 95 — the length is identical and the entropy is not, which is why “how long is it” is only a useful question once the answer to “who chose it” is a random number generator.
Common misconceptions
- “Change it every 90 days.” Modern guidance (NIST SP 800-63B) advises against routine expiry — it just produces
Spring2026!→Summer2026!. Change a password only when you suspect exposure. - “
P@ssw0rdis strong because of the symbols.” Cracking tools try these letter-to-symbol swaps first; a dictionary word with obvious substitutions adds almost nothing. - “A manager is one big single point of failure.” Its vault is encrypted with your master passphrase, and it removes the far bigger risk: reuse.
That also disposes of the most common misconception. Substituting a with @ does not add entropy, because it does not change the pool: the attacker’s dictionary already contains both spellings. What changes the arithmetic is the pool and the length — 62 to the power of 16 for our defaults, or 95 bits expressed the readable way. Four more random characters beat every clever substitution you can think of, and you can check that by multiplying.
How your password should be stored
You can’t control this, but a good service never stores your password in plain text — only a salted hash from a slow algorithm like bcrypt, scrypt or Argon2, never plain MD5. If a site can email you your original password, treat it as a red flag; see is MD5 secure? for why fast hashes fail here.
Mini FAQ
Is SMS 2FA pointless? No — far better than nothing, but an authenticator app or hardware key avoids SIM-swap attacks, so prefer those.
What if a site caps length or bans symbols? Use the longest length allowed and keep it unique — a password generator matches any site’s rules while staying random.