🔑 What Makes a Strong Password (and How to Generate One)

Length, character sets & entropy explained

"Mix in uppercase, numbers, and symbols" is a familiar rule, but what actually determines how hard a password is to crack isn't a rule — it's math. This guide explains what really makes a password strong, and why length matters more than complexity rules.

Entropy — the real measure of password strength

Cracking a password ultimately comes down to how many combinations an attacker has to try. That's quantified as entropy, roughly calculated as log2(charset_size^length). An 8-character password using only lowercase letters has a charset of 26, giving log2(26^8) ≈ 37.6 bits. An 8-character password mixing upper/lowercase, digits, and symbols (roughly 94 characters) gives log2(94^8) ≈ 52.6 bits. That looks like a big jump, but keep the same larger charset and stretch the length to 12 characters instead, and you get log2(94^12) ≈ 78.8 bits — a far bigger gain. In other words, adding a character type or two helps less than adding a few more characters of length.

Why "P@ssw0rd1!" is weak

Rule-based substitutions (a→@, o→0, i→1) satisfy a character-class checkbox, but they don't add much real entropy. These substitution patterns are extremely well known, and cracking tools ship with rule-based attacks that automatically apply exactly these transformations to dictionary words. So P@ssw0rd1! looks complex — uppercase, digits, and a symbol are all present — but to a dictionary attack it's just the common word "password" run through a couple of predictable rules, and it falls much faster than a truly random 12-character string.

What's actually recommended

Following these guidelines gives most personal and work accounts more than enough strength:

At least 12–16 characters — longer when possible
A randomly generated string mixing upper/lowercase, digits, and symbols (avoid memorable patterns)
A completely different password per site — so one breach doesn't compromise every account
Two-factor authentication (2FA) wherever it's offered

What matters more than complexity — no reuse, and a password manager

In practice, accounts get compromised far more often through "credential stuffing" — attackers replaying email/password pairs leaked from an unrelated breach — than through brute force. If you craft one very complex password and reuse it everywhere, a leak on any single site puts every other account at risk. Using a completely different random password per site matters far more than any individual password's complexity, and remembering dozens of unique random strings isn't realistically possible by hand — which is exactly why a password manager is the practical answer.

Rather than agonizing over rules each time, you can generate a cryptographically random password of any length and character set instantly with our free tool.

Entropy by length and character set

Entropy (in bits) expresses, on a log₂ scale, how many guesses it takes to crack a password by brute force. Bits per character = log₂(character-set size); total entropy = bits per character × length.

Character set	Bits/char	8 chars	12 chars	16 chars	20 chars
Digits only (0-9)	3.32	27	40	53	66
Lowercase (a-z)	4.70	38	56	75	94
Mixed case (a-z A-Z)	5.70	46	68	91	114
Alphanumeric (a-z A-Z 0-9)	5.95	48	71	95	119
+ symbols (~94 chars)	6.55	52	79	105	131

These figures assume a randomly generated password. Dictionary words, names, and predictable patterns have far lower real entropy than the table shows.

Estimated crack time by entropy

Entropy	Estimated average crack time
40 bits	~55 seconds
50 bits	~15.6 hours
60 bits	~1.8 years
70 bits	~1,870 years
80 bits	~1.92 million years

Averages assume 10 billion (10¹⁰) offline guesses per second (a weak hash on a GPU). Real times depend heavily on the storage hash (bcrypt, Argon2, etc. are far slower). A practical target is roughly 70 bits or more.