How to Create a Strong Password, and Why Length Beats Complexity
What makes a password hard to crack, how entropy works, when a passphrase is better, and the habits that matter more than any single password.
What attackers actually do
Most stolen passwords are not guessed one by one against a login page. Attackers get a leaked database of hashed passwords and test billions of guesses per second offline, starting with common passwords, dictionary words and predictable patterns such as a capital first letter and a number at the end.
That is why a password like Summer2026! feels complex but is weak: it follows a pattern that cracking tools try early. Strength comes from unpredictability, not from sprinkling in symbols.
Entropy in plain terms
Entropy measures how many guesses an attacker needs. For a password chosen truly at random, it is the length multiplied by the log base 2 of the number of possible characters. Each extra character multiplies the work, so length wins.
The figures below assume every character is chosen at random. Human-chosen passwords have far less entropy than these numbers.
- 8 random characters from 94 printable symbols: about 52 bits, which is weak against offline attacks.
- 12 random characters: about 79 bits.
- 16 random characters: about 105 bits, which is beyond practical brute force.
- 6 random words from a list of 7,776 words: about 77 bits, and much easier to type and remember.
Entropy and guessing time compared
The table lists the entropy of random choices and the time to search half of the possible space. The time column is only a thought experiment that assumes one billion guesses per second, a fixed rate chosen for easy arithmetic. Real attackers differ, and a slow hashing method makes their work harder.
| Password type | Entropy | Time to try half the space |
|---|---|---|
| 8 lowercase letters | 37.6 bits | about 2 minutes |
| 8 letters and digits | 47.6 bits | about 1.3 days |
| 8 from 94 symbols | 52.4 bits | about 35 days |
| 12 from 94 symbols | 78.7 bits | about 7.6 million years |
| 16 from 94 symbols | 104.9 bits | about 5.9 x 10^14 years |
| 4 random words | 51.7 bits | about 21 days |
| 5 random words | 64.6 bits | about 450 years |
| 6 random words | 77.5 bits | about 3.5 million years |
The jump between 8 and 12 characters is the point of the table. Four more characters multiply the work by about 78 million (94 to the power of 4), so length is the cheapest upgrade.
Worked example: why Summer2026! is weak
- It looks complex: eleven characters with a capital letter, digits and a symbol.
- A cracking tool does not try every combination. It takes a word list, adds a capital letter, appends a year and then a symbol.
- Summer is a common word, 2026 is a likely year and the exclamation mark is the most likely ending. The pattern is among the first few thousand rules the tool tries.
- A password manager would instead give a string such as 12 random characters, with no word, no year and no pattern to exploit. That is about 78.7 bits.
A short word-plus-year habit also leaks across sites. If one site is breached, an attacker tries the same pattern with a changed word on your other accounts.
Random characters or a passphrase
Use random characters for anything stored in a password manager, because you never need to type or remember it. Use a passphrase of several unrelated random words for the few secrets you must remember, such as the master password of the manager itself and your device login.
The words must be chosen randomly. A famous quote or a line from a song is not random, and attackers include them in their guess lists.
Habits that matter more than the password
A strong password reused on two sites is only as safe as the weaker site. Use a different password everywhere, which in practice means a password manager.
Turn on two-factor authentication for email, banking and any account that can reset others. An authenticator app or a hardware key is safer than SMS codes. Change a password when a service reports a breach, not on a fixed calendar, since forced rotation tends to produce weaker passwords.
The Password Generator on this site creates passwords in your browser using the secure random source built into it. Nothing is sent to a server, but treat any generated password as secret the moment you copy it.
Common mistakes and how to spot them
- Reusing a password with a small change, such as a different number at the end. Attackers try these variations first.
- Using personal facts such as a pet name, birthday or street. These are easy to find online.
- Replacing letters with symbols, as in p@ssw0rd. Cracking tools know these swaps.
- Storing passwords in a plain note or a browser on a shared computer.
- Choosing the words of a passphrase yourself. Pick them with dice or a generator, not by thinking of a nice phrase.
- Sharing a password through chat or email. Use a manager's sharing feature or a temporary link instead.
Frequently asked questions
- How long should a password be? For a manager-stored password, 16 or more random characters is a good default. For a passphrase you type, use at least five or six random words.
- Are symbols required? Not for strength. Length and randomness matter more, though some sites force symbols, so include them when the form asks.
- Is a password manager safe? A manager with a strong master password and two-factor authentication is safer than reusing passwords from memory. Protect that master password above all.
- How often should I change passwords? Change one when a breach is reported or when you suspect a leak. Changing on a fixed schedule is not needed.
- Is a generated password in the browser safe? Yes, if it uses the secure random source and is not sent anywhere. Copy it directly into your manager.