A strong password is long, random and used on one account only. Length matters more than symbols: every extra character multiplies the number of possibilities by the size of the character set, while adding a symbol class makes each character only slightly harder to guess. A random 16-character password of lowercase letters is stronger than a random 8-character one that uses every kind of symbol. This article puts numbers on that, explains where a passphrase fits, and shows how to make a password in your browser and why that is safe.
How strength is measured
For a password chosen completely at random, strength is counted in bits. The formula is length × log2(size of the character set). Each extra bit doubles the number of passwords an attacker would have to try, so the scale is exponential: 10 more bits means about a thousand times more possibilities.
The size of the set depends on what you allow. Lowercase letters give 26 characters. Adding capitals, digits and the 27 symbols this generator uses gives 26 + 26 + 10 + 27 = 89.
| Password | Set size | Bits |
|---|---|---|
| 6 random digits (a PIN) | 10 | 19.9 |
| 8 characters, every kind | 89 | 51.8 |
| 12 lowercase letters | 26 | 56.4 |
| 12 letters and digits | 62 | 71.5 |
| 16 lowercase letters | 26 | 75.2 |
| 12 characters, every kind | 89 | 77.7 |
| 16 letters and digits | 62 | 95.3 |
| 20 characters, every kind | 89 | 129.5 |
Read it from the top. The 8-character password with every kind of symbol, which many sites teach you to write, sits near 52 bits. Twelve plain lowercase letters already beat it. Sixteen lowercase letters, with no capitals, digits or symbols at all, come close to a 12-character password that has everything.
The reason is simple. One more character adds log2(set size) bits: about 4.7 bits for lowercase letters, 6.0 for letters and digits, 6.5 for the full set. Switching from letters and digits (62) to the full set (89) adds only about 0.5 bits per character. In other words, adding one character is worth roughly as much as switching on symbols for twelve characters at once.
An important limit of these numbers
They are true only for passwords produced by a random process. P@ssw0rd2024! has capitals, digits and a symbol and follows the pattern attackers try first, because people build passwords from words, names, dates and the same predictable substitutions. A password you invent is far weaker than its length suggests. That is the strongest argument for letting a generator pick it.
Passphrases: when you must type it from memory
A passphrase is several random words. If the words are drawn at random from a list of 7,776 words, each word adds log2(7776) = 12.9 bits. The 7,776 figure is 6 to the power 5, which is why the classic method uses five dice rolls per word.
- 4 random words: about 51.7 bits, the same as the 8-character password above
- 5 random words: about 64.6 bits
- 6 random words: about 77.5 bits, the same as 12 characters of every kind
A passphrase is easy to type and to remember, so it suits the few secrets you cannot keep in a manager: the master password of the password manager itself, the login of the computer, a disk-encryption passphrase. The condition is real randomness. Words you choose yourself, a line from a song or a quotation count as a few guesses, not as a random draw. Note that this generator makes passwords of characters, not word passphrases. For a memorised passphrase, use dice and a published word list.
Making a password with the generator
The password generator runs in your browser.
- Set the length. It goes from 4 to 128 and starts at 20. For accounts kept in a password manager, 16 to 24 is a good range.
- Tick the kinds of character: lowercase, uppercase, digits, symbols. All four are on by default, which gives a set of 89 and shows about 129 bits.
- If a site rejects some symbols, type them into "Never use these characters", or untick symbols and add length instead. Without symbols, 17 characters of letters and digits still give about 101 bits.
- For a password you will read aloud or type from paper, tick "Avoid look-alike characters", which removes I, l, 1, O, 0 and a few more. It costs a little strength per character, so add a character or two.
- Press "Generate new" until you are happy, then "Copy". "Hide" blanks the password on screen.
- Paste it into the password field and into your password manager at once. Nothing is saved by the page, so closing it loses the password.
The meter labels are simple bands over the bit count: under 50 is Weak, from 50 to 69 Fair, from 70 to 99 Strong, and 100 and above Very strong. They are this tool's own scale, not an industry standard, and they describe generated passwords only.
Why a browser-generated password is fine
A password is safe if an attacker cannot predict it. What matters is the source of the randomness. This generator uses crypto.getRandomValues, the browser's cryptographically secure random generator, which draws on the operating system's. It does not use Math.random, which is not designed to be unpredictable. When it picks a character it discards any random number that would favour some characters over others, so each allowed character is equally likely. It also guarantees at least one character from each kind you ticked, then shuffles.
Nothing is sent anywhere. You can check: open the browser's developer tools, go to the Network tab, press "Generate new" and see that no request appears. The password exists only in the page's memory until you close it.
The remaining risks are not about where the password was made, and they apply to any generator. Malware on your computer can read what you copy. A malicious browser extension can read pages. A person can look at your screen, and a clipboard history can keep the password. Generate on a device you trust, and clear the clipboard if your system keeps a history.
What matters more than the generator
- One password per account. When a site leaks its data, a reused password opens your other accounts.
- A password manager. It lets every password be long and random without anyone having to remember it.
- Two-factor authentication on email, banking and anything that can reset other accounts.
- No forced composition rules. Guidance such as the NIST digital identity guidelines advises favouring length and checking passwords against lists of known leaked ones instead of requiring a symbol and a number.
- A Wi-Fi password is the one you do type for guests. Make it long and random like the others, then give guests a QR code for the network so nobody has to read it out.
A short checklist
Use a generator, make it at least 16 characters, keep it unique and in a manager, switch on two-factor authentication, and use a random passphrase of five or six words only for the few things you must remember.