Password Generator

Password strength is measured in entropy — the number of bits of uncertainty an attacker faces. It is calculated from the size of the character set and the length:

entropy = length × log₂(character set size)

That formula makes the central point immediately: length is a multiplier and the character set is inside a logarithm. Adding characters helps linearly; adding symbol types helps logarithmically, which is much less.

Length against complexity

The nineteen-character lowercase phrase beats the eight-character password with every symbol type by nearly 37 bits — which is a factor of over a hundred billion in the number of guesses required.

This is why every modern guideline leads with length. A minimum of 12 characters is the current floor and 16 or more is the sensible target, whatever the character set.

Why "P@ssw0rd!" is not strong

The entropy formula assumes the password is random. Almost none are.

An attacker does not try every combination in order. They start with the most likely candidates: leaked password lists containing billions of real passwords, dictionary words, and then dictionary words with the transformations people apply — a for @, o for 0, i for 1, s for $, a capital at the front, a digit and an exclamation mark at the end.

Every one of those substitutions is in every cracking tool's default rule set. "P@ssw0rd!" is found in seconds, and its theoretical entropy of 59 bits is completely irrelevant, because nobody is searching that space at random.

The practical entropy of a human-chosen password is far lower than the formula suggests. Estimates put it at around 20 to 25 bits regardless of how complicated it looks, because the pattern is predictable even when the characters vary.

What the guidance changed

NIST's 2017 revision reversed twenty years of advice, and the reasoning is worth understanding.

Dropped: forced complexity rules. Requiring an uppercase, a digit and a symbol pushes almost everyone to the same pattern — a capitalised word, a digit, an exclamation mark. It narrows the search space rather than widening it.

Dropped: periodic expiry. Forcing a change every 90 days produces Password1, Password2, Password3. Users make the smallest possible change, and the predictability outweighs any benefit. Change a password when there is a reason to.

Added: check against known breached passwords. Far more effective than any composition rule.

Added: allow long passwords and all characters, including spaces and Unicode. Some systems still cap length at 16 or strip symbols, which is a sign of poor storage practice.

Kept: multi-factor authentication, which matters more than the password itself.

Passphrases

Four or five random common words — the approach popularised by the xkcd comic — produce a password that is long, high-entropy and memorable.

The entropy comes from the random selection, not from the words. Choosing four words from a 7,776-word list gives log₂(7776⁴) = 51.7 bits; choosing four words yourself because they mean something gives far less, because your associations are not random.

Use dice or a generator, not your own judgement. That is the entire method — the Diceware approach exists specifically because people cannot select randomly.

Six Diceware words gives 77.5 bits, which is strong enough for a master password.

Where a password actually fails

Most accounts are not lost to brute force. They are lost to one of these:

Credential stuffing. A password leaked from one site is tried on every other site. This is the single largest cause of account compromise, and the only defence is a unique password per site.

Phishing. The password is typed into a convincing fake. Strength is irrelevant; the user handed it over. Password managers help here indirectly — they will not autofill on the wrong domain, which is a genuine signal.

Malware and keyloggers. Strength is again irrelevant.

Server-side breach. The site's own database is stolen. Whether your password survives depends on how they stored it — a modern hash such as Argon2, bcrypt or scrypt resists cracking; plain MD5 does not.

Notice that password strength only protects against one of these, and it is the least common. That is the argument for a password manager and multi-factor authentication over an elaborate memorable scheme.

Password managers

The objection — putting everything in one place — is real and is outweighed.

A manager allows a unique, long, genuinely random password for every account, which defeats credential stuffing entirely. The alternative in practice is not perfect discipline; it is reuse.

Choose one with a zero-knowledge architecture, so the provider cannot read your vault. Protect it with a long passphrase and multi-factor authentication. Export a backup periodically and store it somewhere safe offline.

The master password is the one to make properly strong: six Diceware words, never reused anywhere, never typed on a device you do not control.

Multi-factor authentication

Adding a second factor is worth more than any password improvement, and the options are not equivalent.

Passkeys are the direction things are moving. They replace the password with a key pair held on your device and unlocked biometrically. Nothing shared is reusable, so there is nothing to steal in a breach and nothing to phish.

Where a site offers passkeys, using them is better than any password you could construct.

Where passwords are stored, and why it matters to you

You cannot control how a site stores your password, and knowing what good looks like explains why uniqueness matters so much.

Plain text. The password is in the database as you typed it. A breach exposes every account immediately. The tell: a site that can email you your existing password rather than a reset link.

Unsalted hashes, MD5 or SHA-1. Fast to compute, which means fast to crack. Billions of guesses a second on ordinary hardware, and precomputed tables cover every common password.

Salted modern hashes — bcrypt, scrypt, Argon2. Deliberately slow, with a work factor that can be raised as hardware improves, and a unique salt per password so that identical passwords hash differently. This is what a competent site uses.

The practical consequence for you: you cannot tell which one a site uses, and you should assume the worst. That assumption is exactly why the same password must never appear on two sites — a breach at the weakest site you have ever registered with should not endanger your email.

Checking whether yours has leaked

Services such as Have I Been Pwned hold the passwords from public breaches and let you check yours without sending it.

The mechanism is worth understanding, because it sounds alarming and is not. The client hashes the password with SHA-1, sends only the first five characters of the hash, and receives every hash in the database beginning with those five. The comparison happens locally. The service never learns which password was checked, or whether it matched.

If a password appears, change it wherever it is used and stop using it. A leaked password is in every cracking dictionary within days, whatever its theoretical strength.

What this tool assumes

• Passwords are generated using the browser's cryptographic random number source, not a general-purpose random function.
• Entropy is calculated as length × log₂(character set size), which assumes true randomness — generated passwords qualify, human-chosen ones do not.
• Nothing is transmitted. Generation happens entirely in your browser and no password is logged or sent anywhere.
• Ambiguous characters can be excluded where a password must be read or typed by hand.
• A strong password is one defence among several. Uniqueness and a second factor matter more.