What Makes a Password Strong?
A password's strength is not about how complicated it looks — it is about how many guesses an attacker would need to try before finding it. That quantity is called entropy, and it is measured in bits. Every bit doubles the number of possibilities: a password with 40 bits of entropy has 240 possible values, one with 80 bits has 280. For a password that is generated randomly, entropy is simply the length multiplied by the logarithm (base 2) of the pool of characters it draws from:
Entropy (bits) = Length × log₂(Character pool size)
| Classes Used | Pool Size | Bits per Character |
|---|---|---|
| Digits only | 10 | 3.32 |
| Lowercase only | 26 | 4.70 |
| Lower + upper | 52 | 5.70 |
| Lower + upper + digits | 62 | 5.95 |
| All four classes | 94 | 6.55 |
Two consequences follow directly. First, length is the lever that matters most — each extra character multiplies the possibilities by the whole pool, so going from 12 to 16 characters adds about 26 bits. Second, character variety gives a smaller but real boost, which is why this tool lets you choose which classes to include.
How the Randomness Is Produced
The generator draws every character from crypto.getRandomValues, the browser's
cryptographically secure random number generator. This matters for two reasons. The first is
quality: the values come from OS-level entropy and are unpredictable in both directions — you cannot
guess the next output, and you cannot infer anything about the generator from past outputs. The
second is bias: a naive generator that maps a random byte to an index with a remainder leaves the
last few characters of the alphabet slightly more likely to appear. This tool uses rejection
sampling — generating a fresh byte until it falls in a clean multiple of the alphabet size — so
every character is exactly equally likely, and each generated password is truly uniform across all
possibilities of its length and classes.
Guaranteed Character Mix
Many sites still enforce the classic rule: "must include an uppercase letter, a number, and a symbol." Random passwords rarely satisfy that by pure chance, so this generator reserves one slot for each enabled class before filling the rest of the length randomly, then shuffles the result so the guaranteed characters are not predictably at the front. The outcome is a password that is fully random and still passes every legacy requirement — no re-rolling until one happens to comply.
Interpreting the Strength Meter
The meter next to your password shows its estimated entropy and a rough label. The scale is conventional for offline brute-force resistance:
| Entropy | Label | Perspective |
|---|---|---|
| < 40 bits | Weak | Crackable in seconds to minutes on ordinary hardware |
| 40–60 bits | Fair | Fine for low-value, rate-limited accounts |
| 60–80 bits | Strong | Resistant to large offline cracking efforts |
| > 80 bits | Very strong | Beyond practical brute force even for nation-state budgets |
For a randomly generated password this estimate is exact — the math is not an approximation the way it is for human-chosen passwords, which cluster around dictionary words and patterns no formula can capture. A 16-character all-class password lands at about 105 bits, comfortably in the "very strong" range.
Step-by-Step: Generating a Strong Password
- Set the length to 16 — the default, and a good balance of strength and typability.
- Keep all four character classes enabled, or drop a class if your target site forbids symbols.
- Click Generate Password — the tool produces a fresh random password and shows its entropy (about 105 bits at 16 characters with all classes).
- Copy it into your password manager and store it under the site's name. The password never touches the URL, so nothing leaks into browsing history.
Reference: Password Length vs. Entropy
| Length | All Classes (94) | Lower + Upper (52) | Digits (10) |
|---|---|---|---|
| 8 | 52 bits | 46 bits | 27 bits |
| 12 | 79 bits | 68 bits | 40 bits |
| 16 | 105 bits | 91 bits | 53 bits |
| 20 | 131 bits | 114 bits | 66 bits |
| 24 | 157 bits | 137 bits | 80 bits |
Best Practices & Practical Tips
Use a Password Manager
The most secure password is one you never have to remember. A password manager generates, stores, and autofills a unique random password for every site — you remember one strong master password instead. This tool is designed to feed that workflow: generate here, save there. Managers also defend against phishing, because they refuse to autofill on lookalike domains.
Never Reuse Passwords
Credential-stuffing attacks work because people reuse passwords. When one site leaks its database, attackers immediately try the same email and password on banks, email, and social media. A unique password per site means a breach at one service stays at that service.
Enable Two-Factor Authentication
A strong password protects against guessing; two-factor authentication protects against everything else — stolen databases, keyloggers, phishing. Even a 105-bit password is easier to steal than to crack, so pair long random passwords with TOTP authenticator apps (or passkeys where supported) on every account that offers them.
Common Mistakes to Avoid
- Using a memorable word or pattern instead of a random string — dictionary attacks break these instantly.
- Reusing one strong password across sites — one breach compromises them all.
- Trusting a site's colored "password strength" meter over the actual entropy math.
- Storing passwords in a plain-text notes file or spreadsheet instead of a password manager.
- Letting a generator use
Math.random— it is fast but predictable enough to be a real weakness.