What Makes a Strong Password?

The Short Answer

A strong password has four properties:

1. Long: at least 16 characters; longer is always better
2. Random: generated by a machine, not chosen by a human
3. Varied: uses multiple character types (upper, lower, numbers, symbols)
4. Unique: never reused across accounts

If you use a randomly generated 16-character password with all character types, stored in a password manager, for every account, you are doing more for your security than 95% of people. The rest of this guide explains why.

1. Length: The Most Important Factor

Password strength scales exponentially with length. Every additional character multiplies the number of possible combinations by the size of the character pool.

Using a pool of 92 printable ASCII characters:

• 8 characters → 92⁸ ≈ 5.1 quadrillion combinations (52 bits)
• 12 characters → 92¹² ≈ 470 quintillion combinations (78 bits)
• 16 characters → 92¹⁶ ≈ 43 sextillion combinations (105 bits)
• 20 characters → 92²⁰ ≈ 4 septillion combinations (131 bits)

A high-end GPU cluster running at 10 trillion guesses per second would need:

• 8 characters → ~7 minutes on average
• 12 characters → ~74 years
• 16 characters → ~68 million years
• 20 characters → far longer than the age of the universe

The jump from 12 to 16 characters is worth more than adding any combination of symbols to a short password.

Why 8-character minimums are outdated

Many sites still enforce an 8-character minimum. This minimum was set when offline GPU cracking was orders of magnitude slower than it is today. A strong 8-character password from 2010 might survive hours; on modern hardware, it might fall in minutes against a fast hash (MD5, SHA-1). The minimum you should aim for is 12 characters; 16+ is the current best-practice recommendation.

2. Randomness: The Second Most Important Factor

A 20-character password that you chose is almost always weaker than it appears. The reason is that humans are predictable in ways that cracking tools exploit.

How attackers exploit human patterns

Modern cracking tools do not start with "aaaaaa" and work alphabetically. They start with:

• Lists of the 10 billion most common passwords (from real breaches)
• Dictionary words in every language
• Common substitutions: @ for a, 3 for e, 0 for o, ! at the end
• Names + years (birthdays, significant years)
• Keyboard patterns: qwerty, asdfgh, 1q2w3e
• Markov-chain models trained on human password behaviour

A password like Fluffy2023! has a theoretical entropy of ~37 bits, but its real-world crack time against a targeted dictionary attack is seconds. The actual entropy is close to zero because every element is predictable.

What true randomness means

A truly random password is one where each character is independently selected with equal probability from a defined set, using a source of randomness that an attacker cannot predict. This is what crypto.getRandomValues() provides, and it's why this generator uses it exclusively, never Math.random().

3. Character Variety

Character variety increases the pool size, which increases entropy per character. The four main types and their contributions:

• Lowercase letters (a–z): +26 characters
• Uppercase letters (A–Z): +26 characters
• Numbers (0–9): +10 characters
• Symbols (!@#$…): +32 characters

With all four types: pool = 94 characters, log₂(94) ≈ 6.55 bits per character.

With only lowercase: pool = 26 characters, log₂(26) ≈ 4.70 bits per character.

That difference per character is significant, but adding length is always a bigger gain than adding character types. A 20-character lowercase-only random password (94 bits) is stronger than a 12-character all-types password (78 bits).

The practical case for symbols

Symbols add 32 characters to the pool, the single largest addition of any character type. They raise entropy per character from ~6.0 bits (letters + numbers) to ~6.5 bits (all types). More concretely: on a 16-character password, enabling symbols adds roughly 8 bits of entropy, equivalent to adding 1–2 extra characters.

The downside: some websites, services, and systems reject certain symbols in passwords, and some devices (smart TVs, router interfaces) make symbols hard to type. If compatibility matters, letters + numbers at greater length is a viable alternative.

4. Entropy: The Combined Measure

Entropy brings length and variety together into a single number. The formula is:

Entropy (bits) = length × log₂(pool size)

A password with N bits of entropy has 2ᴺ possible values. The average attacker needs to try 2^(N-1) values to find it.

Entropy thresholds for guidance:

• < 28 bits: Trivially crackable, change immediately
• 28–59 bits: Weak to Fair, inadequate for important accounts
• 60–79 bits: Strong, adequate for most everyday accounts
• 80+ bits: Very Strong, recommended for high-value accounts

Important caveat: these entropy figures assume the password is truly randomly generated. For human-chosen passwords, effective entropy is much lower than the formula suggests, because humans draw from a much smaller implicit pool of choices.

Use our Password Entropy Calculator to see the entropy of any password.

5. Uniqueness Across Accounts

A strong password reused across multiple accounts is effectively a weak password. When a site storing your password is breached, attackers immediately try the leaked password on other sites (credential stuffing). A single breach can cascade into account takeovers across your entire digital life.

The only practical solution: use a different randomly generated password for every account, stored in a password manager. You only need to remember one master password (for the manager) and a handful of critical ones you genuinely can't store (device logins, the manager itself).

Common Password Mistakes

Mistake 1: Using personal information

Attackers building targeted wordlists can find your name, birthday, hometown, children's names, and pet names from social media within minutes. Any password derived from this information is vulnerable to targeted attacks.

Mistake 2: The "secure-looking" pattern

Tr0ub4dor&3 looks strong. It has uppercase, lowercase, numbers, a symbol, and 11 characters. Its theoretical entropy is ~72 bits. But this specific string (from the XKCD comic) is now in every cracker's dictionary. More importantly, the pattern (word plus leet substitutions plus an appended number or symbol) is extremely common, and cracking tools model it explicitly.

Mistake 3: Reusing passwords

As of 2024, billions of password-email pairs from breached databases are freely available. Credential stuffing tools test these pairs against every major service automatically. If you reuse passwords, a breach of any one service can compromise all others.

Mistake 4: Incrementing

MyPassword1 → MyPassword2 → MyPassword3. Cracking tools and attackers try this pattern explicitly when they find an old password.

Mistake 5: Short + complex vs. long + simple

Many people believe a complex 8-character password is better than a simple 16-character one. It is not. xK#9mP$v (52 bits) is weaker than flameriverboltecho (85 bits, a random passphrase). Length wins.

Entropy Reference Table

All entropy figures assume true random generation. Human-chosen passwords have much lower effective entropy regardless of length.

Practical Recommendations

For accounts stored in a password manager

• Use a randomly generated password, 16+ characters
• Enable all character types (unless the site disallows symbols)
• Use a different password for every account
• Enable 2FA on every account that supports it

For your password manager master key

• Use a random passphrase: 5-6 words from our Passphrase Generator
• Practice typing it until it's memorised
• Store a written backup in a physically secure location

For accounts you must memorise

• Use a 4-6 word random passphrase (not personally meaningful words)
• Enable 2FA: a strong passphrase with 2FA is resistant to almost all remote attacks

Frequently Asked Questions

Related Guides