Most password advice comes down to three words: long, random, unique. This guide explains why, how password strength is measured, and how to apply it without memorizing dozens of strange strings.

You can create random passwords in your browser with the QuickToolsBox Password Generator. It uses your browser's built-in cryptographic random number generator, and the password is not sent anywhere.

How attackers actually guess passwords

Most break-ins do not involve someone typing guesses into a login box. Two methods are far more common:

  • Offline cracking. When a website's password database leaks, attackers can test enormous numbers of guesses per second against the stolen hashes. Fast hardware makes short and predictable passwords fall quickly.
  • Credential stuffing. Attackers take email and password pairs from one breach and try them on other sites. If you reuse a password, one leak exposes every account that shares it.

Both attacks punish passwords that are short, predictable, or reused. They do much less against a long random password that is unique to one site.

Entropy: measuring strength

Security people measure a random password's strength in bits of entropy. Each extra bit doubles the number of guesses an attacker needs. For a password where every character is chosen at random from a set of N characters, entropy is the length multiplied by log base 2 of N.

| Example | Approximate entropy | |---|---| | 8 random characters from letters, digits, and symbols (about 94 options) | 52 bits | | 12 random characters from the same set | 79 bits | | 16 random characters from the same set | 105 bits | | 20 random lowercase letters (26 options) | 94 bits | | 6 random words from a list of 7,776 words | 78 bits |

These figures apply only when the characters or words are truly random. A password like Summer2026! looks complex but follows a predictable pattern, so its real strength is far lower than the character count suggests.

Why length beats complexity

Requiring "one uppercase letter, one number, and one symbol" mostly produces predictable results, such as a capital at the start and an exclamation mark at the end. Adding length increases strength much faster. Twenty random lowercase letters have more entropy than 12 random characters from the full keyboard, and they are easier to type on a phone.

Current guidance from standards bodies such as NIST emphasizes length, allowing long passwords including spaces, checking new passwords against lists of known breached passwords, and not forcing people to change passwords on a schedule without a reason. Arbitrary composition rules and frequent forced changes tend to push people toward weaker, more predictable passwords.

Random passwords versus passphrases

  • A random password such as v7Kq!9mRt2Lw#xZp is strong, but hard to remember. It is a good fit for accounts you reach through a password manager.
  • A passphrase is several random words, such as lantern-orbit-pepper-canyon-drift-harbor. Six or more words chosen at random give good strength and are easier to remember and type. It suits the few passwords you must remember, such as your password manager's master password and your computer login.

The words must be chosen randomly, for example with dice or a generator. A phrase you invent, like a quote or a line from a song, is far easier to guess than it feels.

Use a password manager

Nobody can remember dozens of unique random passwords, which is why people reuse them. A password manager stores them encrypted behind one strong master password, fills them in for you, and creates new ones when you sign up. Browsers and operating systems include basic managers, and dedicated apps offer more features. The most important step is to use one consistently.

Turn on a second factor

Even a strong password can be phished or leaked by the site. Two-factor authentication adds a second check. An authenticator app or a hardware security key is generally stronger than a code sent by text message. Passkeys, now supported by many large services, replace the password with a device-based credential that cannot be reused on a fake site, and are worth enabling where offered.

Practical checklist

  1. Use a unique password for every account.
  2. Make passwords at least 14 to 16 characters when the site allows it, and longer for important accounts.
  3. Let a password manager generate and store them.
  4. Memorize only the master password and device logins, as passphrases of six or more random words.
  5. Turn on two-factor authentication or passkeys for email, banking, and your password manager.
  6. Change a password promptly if a service tells you it was breached, not on a fixed schedule.

Mistakes to avoid

  • Personal details. Names, birthdays, pet names, and addresses are easy to guess from social media.
  • Small tweaks to an old password. Adding a digit or changing a letter to a symbol is something cracking tools try automatically.
  • Reusing one password with a prefix per site. If an attacker sees one, the pattern is obvious.
  • Typing a real password into an unfamiliar tool. A generator that runs in your browser is fine for creating one, but you should never paste an existing password into a website you do not trust.
  • Storing passwords in a plain note or a spreadsheet that is synced without protection.