Why entropy is what actually matters
Password strength is measured in bits of entropy — how many guesses an attacker needs to try on average to crack it. A password with 60 bits of entropy requires 2^60 guesses on average — over a quadrillion attempts. At one billion guesses per second (a realistic GPU attack rate), that takes over 36,000 years.
The number of characters and the character set determine entropy:
- 8 characters, lowercase only: ~37 bits — crackable in hours
- 8 characters, mixed case + digits + symbols: ~52 bits — crackable in weeks
- 16 characters, lowercase only: ~75 bits — effectively uncrackable
- 4 random words (like "correct horse battery staple"): ~44 bits per word × 4 = ~77 bits — effectively uncrackable
The correct-horse-battery-staple insight
The xkcd comic that popularized "correct horse battery staple" made a real mathematical point. Four random common words produce a password with more entropy than a shorter complex one — and it is far easier to remember.
The key word is random. "ilovemydog2006" is not a passphrase — it is predictable. A truly random selection of words from a large word list (like the EFF word list with 7,776 words) gives ~12.9 bits of entropy per word. Four words gives ~52 bits, five words gives ~65 bits.
The two types of strong passwords and when to use each
Random character strings (like xK9#mQ2!vB3p) are ideal when:
- You are using a password manager and never need to type or remember the password
- The site has a character limit that prevents long passphrases
- You need maximum entropy in minimum characters
Passphrases (like correct-horse-battery-staple) are ideal when:
- You need to type the password regularly (disk encryption, computer login)
- You need to share it verbally or remember it without a manager
- The site does not have a maximum length restriction
What makes a password weak
Attackers do not guess randomly. They use dictionaries — lists of known passwords, common words, and variations. These attacks catch:
- Any word in a dictionary, even with obvious substitutions (p@ssword, passw0rd)
- Names followed by years (john2019, sarah1987)
- Keyboard walks (qwerty, 123456, asdfgh)
- Any password from previous data breaches — these are in every attacker's wordlist
Check if your email has appeared in known breaches at haveibeenpwned.com. Any password associated with a breached account should be changed immediately.
How to generate a strong password now
Use the free password generator— it uses the browser's cryptographically secure random number generator (crypto.getRandomValues), which is specifically designed to produce values that cannot be predicted. Generated passwords are never sent to any server.
For a random character password: select at least 16 characters with uppercase, lowercase, digits, and symbols.
For a passphrase: select the passphrase option, which picks words randomly from a large word list. Four words minimum, five or six for high-security accounts.
Reuse is the biggest risk
The most dangerous password habit is not using a weak password — it is using the same password on multiple sites. When one site suffers a breach, attackers immediately try the leaked credentials on every major service (credential stuffing). Unique passwords for every account eliminate this attack entirely.
The only practical way to have unique strong passwords for every service is a password manager. Generate a random 20-character password per site, store it in the manager, and use the master password + 2FA to protect the manager itself.
Summary
- Aim for at least 16 characters or a 4-word passphrase for new passwords
- Use cryptographic randomness — not a pattern you make up
- Never reuse passwords across different sites
- Use a password manager so you only need to remember one master password
- Generate passwords with the free password generator — nothing leaves your browser