What actually makes a password strong
The two factors that matter most are length and randomness. Neither clever substitutions (using @ for a or 3 for e) nor a mix of upper and lowercase letters compensates for a short or predictable password.
A 6-character password, even with symbols, is crackable in seconds with modern hardware. A 20-character random password from a broad character set would take longer than the age of the universe to brute-force.
Length
Password length is the single most important factor. Each additional character multiplies the number of possible passwords by the size of the character set.
With a 72-character set (uppercase, lowercase, digits, common symbols):
| Length | Possible combinations |
|---|---|
| 8 | ~722 billion |
| 12 | ~19 quadrillion |
| 16 | ~475 quintillion |
| 20 | ~11 sextillion |
Modern GPUs can test billions of password guesses per second against a leaked hash. At 10 billion guesses per second:
- An 8-character password: crackable in under a minute.
- A 16-character random password: would take thousands of years.
Recommendation: Use at least 16 characters for important accounts (banking, email, primary passwords). 12 characters is acceptable for lower-stakes accounts if you have many to manage.
Character variety
A larger character set means more possible passwords per character of length.
| Character set | Size |
|---|---|
| Lowercase only | 26 |
| Lowercase + digits | 36 |
| Upper + lowercase + digits | 62 |
| Upper + lower + digits + symbols | ~72–95 |
Mixing character types increases security, but length remains the dominant factor. A 20-character lowercase-only random password is stronger than an 8-character password with every character type.
Why predictable passwords are weak
Password crackers don't only try random guesses — they try known patterns first:
- Dictionary attacks — every word in every language, with common substitutions applied.
- Rule-based attacks — "password" → "P@ssw0rd", "p@55word", "Password1!" (all trivially cracked).
- Leaked password databases — billions of real passwords from past data breaches are freely available. If your password appears in any of them, it is already compromised.
Common patterns that feel strong but aren't:
- A word with some letters replaced by symbols (
S3cur!ty) - A word followed by numbers (
dragon2024) - Your name and birth year (
alice1990) - Keyboard patterns (
qwerty,123456,!QAZ2wsx)
These patterns are well-known and are among the first things crackers try.
True randomness
A password is only as unpredictable as the process that generated it. A password you think up yourself is influenced by your memory, habits, and the words and numbers meaningful to you — all of which reduce the actual search space a cracker has to cover.
A cryptographically random password generated by a tool has no such biases. Every character is chosen independently with equal probability from the allowed set. This makes the resulting password as hard to guess as the mathematics says it should be.
The Password Generator uses the browser's built-in crypto.getRandomValues() API for cryptographically secure randomness — the same standard used for cryptographic key generation.
Password managers
Generating strong random passwords is only useful if you can also remember or store them. For most people, using a different strong password for every account is only practical with a password manager.
A password manager:
- Stores all your passwords in an encrypted vault.
- Generates strong random passwords on demand.
- Fills them in automatically so you never have to type them.
- Means you only need to remember one strong master password.
Popular options include Bitwarden (open-source), 1Password, and Dashlane. Browser-built-in password managers (Chrome, Safari, Firefox) are better than nothing, though they are less flexible for cross-device use.
Avoiding password reuse
Using the same password on multiple sites means one breach exposes all of them. This is called credential stuffing — attackers take username/password pairs from one breach and automatically try them on other sites.
It is one of the most common attack vectors, and it is entirely preventable with unique passwords per site.
A note on security
No password is absolutely unbreakable. Security is about raising the cost of an attack beyond what is practical. A long, random, unique password protects against brute-force attacks, dictionary attacks, and credential stuffing. It does not protect against:
- Malware on your own device (a keylogger can capture what you type).
- A compromised server storing passwords incorrectly.
- Phishing (you entering your password on a fake site).
For important accounts, combine a strong password with multi-factor authentication (MFA) — even if your password is leaked, MFA requires a second factor that an attacker is unlikely to have.