How to Create a Strong Password (and Why Length Beats Complexity)

A strong password is long and random: at least 16 characters picked by a generator, or a passphrase of five or more words chosen at random from a word list. Length matters far more than symbols, because every extra character multiplies the number of guesses an attacker needs, while adding a ! to a short password barely moves it. Use a different one for every account and keep them in a password manager.

Why length wins

The strength of a random password is measured in bits of entropy, which is the logarithm of the number of possible passwords. Each character drawn from a set of N symbols adds log2(N) bits:

• Lowercase letters only (26): about 4.7 bits per character.
• Letters and digits (62): about 5.95 bits.
• All printable ASCII with symbols (94): about 6.55 bits.

Now compare two passwords. Eight characters from the full 94-symbol set give 52 bits. Sixteen lowercase letters, with no digits or symbols at all, give 75 bits. The boring long one is about 7 million times harder to guess than the short complex one. Sixteen characters from the full set reach 105 bits, which is beyond any brute-force attack that exists today.

The reason is simple arithmetic. Adding a character class multiplies the search space by a small factor. Adding a character multiplies it by N again. Doubling the length squares the number of possibilities.

What cracking speed looks like

When a site is breached, attackers rarely get the passwords themselves. They get hashes, which are one-way fingerprints, and they guess passwords offline until a guess produces the same hash. Against a weak, fast hash such as MD5 or NTLM, a single modern GPU rig can test on the order of 100 billion guesses per second. At that rate:

• Every 8-character password from 94 symbols falls in about 17 hours.
• Every 12-character password takes about 150,000 years.
• Every 16-character password takes longer than the age of the universe.

Sites that store passwords properly use slow hashes such as bcrypt, scrypt or Argon2, which cut guess rates by factors of thousands. You cannot see how a site stores your password, so assume the worst and choose a length that survives it.

You can see what a hash looks like by typing a word into the Hash Generator. The SHA-256 of hello begins 2cf24dba and never changes, which is exactly why a leaked hash of a common password is trivial to reverse with a precomputed list.

Humans are bad at random

Attackers do not start with brute force. They start with lists: every password from previous breaches, dictionary words, keyboard walks like qwerty123, and the usual substitutions. P@ssw0rd! scores well on a complexity meter and falls in under a second, because cracking tools apply the same a to @ and o to 0 rules people do.

Patterns people invent are predictable: capital letter first, number and symbol at the end, a pet or a year somewhere. That is why "complexity requirements" produced so little real security and why the current guidance from NIST, in SP 800-63B, drops composition rules entirely. It asks for a minimum of 8 characters, recommends 15 or more, allows at least 64, and tells sites to check new passwords against breach lists instead of demanding symbols.

The fix is to not choose the password yourself. A generator picks each character independently and uniformly, so there is no pattern to exploit. The Password Generator lets you set the length and toggle uppercase, lowercase, digits and symbols, shows a strength meter as you adjust, and runs in your browser without sending the result anywhere.

A password manager changes the whole problem. You only need to memorise one strong master passphrase. Everything else can be a unique, random 20-character string you never see, which also stops a breach at one site from unlocking your other accounts.

Passphrases for the ones you must type

Some passwords have to be typed from memory: the master password for a manager, a laptop login, a disk encryption key. Here a passphrase works better than random characters. Pick words at random from a large list, join them with spaces or hyphens, and you get something like tundra-marble-nine-copper-violet.

Diceware lists have 7776 words, so each randomly chosen word adds about 12.9 bits. Five words give 65 bits and six give 78, matching a 12-character random password while being far easier to remember and type. The words must be chosen by chance, not by you; a sentence you make up has far less entropy than it appears to. If you do not own dice, the Random Number Generator can produce integers from 1 to 7776 to index into a word list.

Rules that still apply

• One password per account. Reuse is the main way breaches spread.
• Turn on two-factor authentication where offered. It protects you even when the password leaks.
• Change a password when there is a reason, such as a breach notice, not on a schedule.
• Do not share passwords over email or chat, and do not store them in a plain text file.
• Security questions are passwords too. Answer them with random strings and store those in your manager.

Other generators for tokens, UUIDs and keys live in the random category.

Try it

Open the Password Generator, set the length to 20, keep every character set on, and copy the result into your password manager. Generate a fresh one for each account.