Most advice about passwords describes what they should look like: a capital letter, a digit, a symbol. That gets it backwards. A password is strong if it is hard to guess, and how hard it is to guess depends on how it was made, not on how it looks. To see why, start with how guessing is actually done.
How passwords get guessed
Online guessing
The simplest attack is trying passwords against a login form. It is slow, because a reasonably built site limits attempts, adds delays, or locks the account. An attacker gets few tries and spends them on the most common passwords and on anything they know about you. Any password that is not common and not personal holds up.
Offline guessing
The serious attack happens after a site's user database is stolen. Sites are supposed to store a hash of each password, not the password: the output of a one-way function that is easy to compute and impractical to reverse. An attacker with the hashes can still guess. They hash a candidate, compare it with the stolen value, and repeat, on their own hardware, with no rate limit and no lockout.
How fast that goes depends on how the site hashed. A general purpose hash such as MD5 or SHA-1 is built for speed, and graphics cards can try an enormous number of candidates per second. Functions designed for passwords, such as bcrypt, scrypt and Argon2, are deliberately slow and cut that rate by orders of magnitude. You can't see which one a site uses, so the only safe assumption is the fast one.
Attackers don't guess in alphabetical order. They start with lists of passwords from earlier breaches, then dictionary words, names and dates, then those same words run through the changes people make: a capital at the front, a digit or an exclamation mark at the end, a zero for an o. Only after that do they try every combination of characters, and that last stage is the only one where length and randomness are all that matter.
Reuse and credential stuffing
The third attack needs no guessing. When one site is breached and its passwords are recovered, attackers take the email and password pairs and try them on other sites automatically. This is called credential stuffing. If you use one password in two places, the weaker site decides how safe the stronger one is.
Why complexity rules disappoint
Rules that demand a capital, a digit and a symbol were meant to make passwords less predictable. In practice people satisfy them in the same few ways, and those ways are exactly the transformations a guessing tool applies to its word list. A word with a capital first letter and a digit and symbol on the end ticks every box and falls early.
Rules that force a change every few months have a similar problem. People respond by incrementing a number. Change a password when you have reason to think it leaked, not on a calendar.
Length and randomness
The honest measure of strength is how many possibilities an attacker has to work through, assuming they know your method but not your result. For a password picked at random, that is easy to calculate: the number of symbols you chose from, multiplied by itself once per character. It is usually written in bits of entropy, where each extra bit doubles the work.
- A random lowercase letter adds about 4.7 bits. Twelve of them come to about 56.
- A random character from letters, digits and common symbols adds roughly 6.5 bits. Twenty of them come to about 130.
- A word picked at random from a list of 7,776 adds about 12.9 bits. Five such words come to about 65, six to about 78.
Two things follow. Length does most of the work: adding characters raises the total faster than widening the alphabet. And none of the arithmetic applies to a password you thought up. A phrase from a song, a keyboard pattern or a pet's name with a year is drawn from a far smaller set than its length suggests, and that set is on the attacker's list. Randomness has to come from a machine or from dice.
The password generator on this site does that. It builds a password of 8 to 64 characters from the character sets you select, using your browser's cryptographic random number generator, and shows the entropy in bits for the settings you chose. The password is created on your device and is not sent anywhere.
A password manager makes this practical
Nobody can remember a different twenty-character random string for every account, and nobody should try. A password manager generates them, stores them encrypted, and fills them in. That solves reuse completely: every site gets its own password, so a breach at one exposes nothing elsewhere.
It also helps against phishing. A manager offers to fill a password only on the site it was saved for, so a fake login page at a lookalike address gets no offer.
You are left with a few passwords to remember: the one that unlocks the manager, your main email account, and your device logins. Use a passphrase for these. Five or six words chosen at random resist offline guessing and are far easier to type and recall than a string of symbols.
A second factor for what matters
Two-factor authentication means a stolen password alone isn't enough to log in. It covers the cases a strong password can't: phishing, malware, a breach you haven't heard about yet. The common forms are not equal.
- Codes by text message are better than nothing, but they depend on your phone number, which can be transferred to someone else's SIM by tricking your carrier.
- Authenticator apps generate codes on your device from a secret shared at setup. They don't depend on your phone number. A code can still be typed into a fake site.
- Security keys and passkeys are tied to the real site's address and won't respond to a lookalike, which makes them resistant to phishing.
Turn it on for your email first. Email is where password resets go, so whoever controls it can take over most of your other accounts. That is also a reason to keep your main address out of signups you don't care about, which is what a disposable address is for. Then protect the password manager, then anything involving money, and save the recovery codes somewhere other than the device you might lose.
Checking a password against known breaches
Passwords from past breaches circulate in large lists, and those lists are the first thing a guessing tool tries. A password that appears in them is weak no matter how it looks. Checking is useful, but typing a password into a website to ask whether it is safe is an obvious problem.
The answer is a technique called k-anonymity. The password breach check here works this way:
- Your browser computes the SHA-1 hash of the password, a string of 40 hexadecimal characters.
- It sends only the first 5 characters of that hash to the breach-checking service.
- The service replies with the rest of every breached hash that starts with those 5 characters, each with a count of how often it has been seen.
- Your browser looks for your hash's remaining 35 characters in that list and shows the count if it finds them.
The service learns a 5-character prefix shared by a large number of unrelated passwords. It never receives the password or its full hash, and can't tell which entry in its reply you were looking for, or whether any matched.
Read the result carefully. A match means don't use that password anywhere. No match means only that this exact password is not in the data that was checked. Something built from your own details can be absent from every list and still be guessable. It is also better practice to check a password you are considering than one that protects an account today.