Secure Password Generator

What Makes a Password Strong — Entropy Explained

Password strength is measured in bits of entropy:

$$\text{Entropy (bits)} = \text{Length} \times \log_2(\text{Pool Size})$$

Pool size is how many possible characters could appear at each position. Every extra character in your pool adds a little entropy per position, but every extra character in length multiplies the total number of possible passwords, which is why length matters more than most people realize.

Common Password Mistakes to Avoid

Reusing the same password across multiple sites means one breach compromises everything. Predictable substitutions (like "P@ssw0rd") add far less randomness than people assume, since attackers already account for them. And short passwords, even with symbols and mixed case, are dramatically weaker than long ones — an 8-character password with everything included is still weaker than a 16-character password of lowercase letters alone.

Why Password Length Matters More Than Complexity

Each additional character multiplies the total possible combinations by the pool size, while each additional character type only adds a modest amount to the pool itself. A 20-character password using only lowercase letters has more possible combinations than an 8-character password using every character type combined — length wins.

How Password Managers Help

Password managers let you use a unique, randomly-generated password (like the ones this tool creates) for every single account without having to remember any of them — you only need to remember one master password. This eliminates the reuse problem entirely and removes the temptation to pick memorable, weaker passwords.

Worked Example: Calculating Entropy for a 12-Character Password

A 12-character password using lowercase letters, uppercase letters, digits, and symbols draws from a pool of roughly 94 printable characters. Entropy is $12 \times \log_2(94) \approx 12 \times 6.55 \approx 78.7$ bits. Compare that to a 12-character password using only lowercase letters (pool of 26): $12 \times \log_2(26) \approx 12 \times 4.70 \approx 56.4$ bits — over 22 bits weaker, even at the same length, because each character contributes less uncertainty when it can only be one of 26 things instead of 94.

Estimated Time to Crack — What the Numbers Mean

This calculator estimates crack time assuming an attacker can try 10 billion guesses per second (a rough proxy for offline brute-force attempts against a stolen password hash using modern hardware), and that on average a match is found after searching half of the total combination space rather than all of it. Real-world crack time varies enormously based on the target's hashing algorithm — a properly salted and hashed password can be orders of magnitude slower to crack than this raw estimate, while a weakly hashed one can be faster.

A Brief History of Password Guidance

Much of the "complex password" advice familiar today — mixing uppercase, lowercase, numbers, and symbols, changing passwords every 90 days — traces back to a 2003 NIST (U.S. National Institute of Standards and Technology) publication authored by Bill Burr, then a manager at the agency. Burr has since publicly said he regrets much of that guidance, and NIST formally revised its recommendations in 2017 to favor length and uniqueness over forced complexity and frequent changes, since research showed the old rules often pushed people toward predictable patterns (like adding "!1" to the end of a familiar word) that didn't meaningfully improve real-world security while making passwords harder to remember. The concept of entropy used to measure password strength borrows directly from information theory, developed by mathematician Claude Shannon in his foundational 1948 paper, which quantified how much genuine uncertainty (and therefore resistance to guessing) is contained in a string of symbols.

Password Terms You Should Know

Entropy — a measure, in bits, of how unpredictable a password is; higher entropy means exponentially more possible combinations an attacker would need to try.

Brute-Force Attack — an attack method that simply tries every possible combination until it finds a match, made faster or slower depending on password length and character variety.

Salting — adding random data to a password before hashing it, so that even identical passwords produce different stored hashes, defeating precomputed lookup-table attacks.

Credential Stuffing — an attack that reuses passwords leaked from one breached site to try logging into other sites, which is why using a unique password per account matters as much as password strength itself.