Generators·4 min read

What Makes a Password Strong: Length, Entropy, Randomness

Most password advice was written for a world of eight character limits and quarterly reset policies. What makes a password strong today comes down to two things: how many characters it has, and whether each one was chosen by genuine randomness instead of a human brain. This article walks through the entropy math with concrete numbers, explains how your browser generates cryptographically secure passwords without involving any server, and settles the passphrase question honestly. By the end you'll know exactly which slider matters and which checkbox matters far less than corporate policy suggests.

Open the tool All insights

The complexity theater behind weak passwords

Rules that feel strict but crack fast.

P@ssw0rd1! satisfies nearly every corporate policy on earth: uppercase, lowercase, digit, symbol, ten characters. It also falls in milliseconds, because cracking software has known about capital-first, symbol-last, o-becomes-zero substitutions since the 2009 RockYou breach handed attackers 32 million real examples to learn from.

Humans asked to add complexity all do it the same way. The capital letter goes first, the number and punctuation go last, and vowels become digits. Cracking tools encode those habits as mutation rules, so a policy-compliant human password often has less practical strength than eleven random lowercase letters.

What makes a password strong: counting the bits

Strength has a unit, and it's bits of entropy: the length multiplied by the base-2 logarithm of the alphabet size. Each fully random character from a mixed 88 symbol alphabet contributes about 6.46 bits, while a lowercase-only character contributes about 4.7.

Run the numbers on this site's generator at its defaults. Input: length 16 with all four classes ticked. Output: something like j9!Kd@2mQx#7vTpL, carrying 16 times 6.46, roughly 103 bits. Every additional bit doubles the work an attacker faces, and 103 bits sits comfortably beyond any brute force campaign that current hardware could mount.

Why length beats complexity in password cracking

Here's the comparison that changes minds. Twelve characters drawn from all four classes: about 78 bits. Twenty characters of nothing but lowercase letters: about 94 bits. The plain-looking long one is over sixty thousand times harder to exhaust, despite failing most complexity policies.

The reason is structural. Adding a character multiplies the search space by the whole alphabet size, while widening the alphabet only improves the multiplier applied at each position. Length beats complexity because it compounds; symbols merely tweak the base. When a site caps symbols or breaks on them, dragging the length slider four notches higher recovers everything the missing class gave up.

Crypto-random passwords straight from the browser

The entropy math only holds if every character is genuinely unpredictable, and that's a hardware problem, not a creativity problem. Browsers expose crypto.getRandomValues(), which draws from the operating system's entropy pool, the same source that seeds TLS keys. The Password Generator fills a typed array from it and maps each value onto your chosen alphabet.

This is also why no network connection is involved. The randomness originates on your device, the string is assembled in tab memory, and closing the page destroys it. Contrast that with Math.random(), which was never designed for secrets: its internal state can be recovered from a handful of outputs, making every subsequent value predictable.

Passphrases vs random strings: two roads to a strong password

Passphrases vs random strings is less a battle than a division of labor. A four word Diceware passphrase carries about 51 bits, six words about 77, and its superpower is that a human can hold it in memory and type it on a phone keyboard without swearing.

Random strings win everywhere memory isn't required, which for most people is every credential except one. The pragmatic split: a long passphrase guards your password manager, and generated 16 to 24 character strings guard everything inside it. You memorize one secret and outsource the other two hundred.

Password mistakes that show up in every breach report

The same handful of habits keeps doing the damage year after year:

Reusing one password across sites, which converts a single forum breach into a compromised email account through credential stuffing.
Building from personal facts, since pet names, birthdays, and street names all appear in targeted wordlists within minutes of profiling.
Rotating by mutation, where Summer2025! becomes Summer2026! and any attacker holding the old hash guesses the new one on the first try.
Protecting a vault of strong credentials with a weak master phrase, which concentrates all the risk in the one secret that was never generated.

Three habits that keep passwords strong

First, make 20 characters your personal default and stop thinking per-site; storage is the manager's job, so extra length costs you nothing. Second, generate a fresh string for every account, because uniqueness is what turns a breach elsewhere into a non-event for you. Third, turn on two factor authentication for email and banking, since even a perfect password can be phished, and a second factor caps the damage.

Password Generator or another random tool on this site

Reach for the Password Generator whenever the output must stay secret: logins, API credentials, database users, router admin panels. The Username Generator solves the opposite problem, producing memorable public handles that were never meant to be hidden. The UUID Generator creates unique identifiers for records and requests, unique but not confidential, and the Hash Generator digests existing data rather than inventing secrets. If it guards access, generate it here; if it labels something, use one of the others.