A password worth keeping: length, randomness, and what "strong" means

Why you’d do this

Most weak passwords are not weak because someone failed to use a symbol. They are weak because a person chose them. People pick names, dates, keyboard patterns and small changes to an old password, and attackers build their guessing lists from exactly those habits. A password drawn by a machine from a large set of possibilities has no habit to exploit.

Two things decide how hard a password is to guess: how many possibilities it was drawn from, and whether the draw was truly random. This guide covers both, shows how to make a password or a passphrase with the Password Generator, and explains how to read the strength label without over-trusting it.

How, with the named tool

Password Generator has two tabs, Generate and Check, and everything runs in your browser.

1. Stay on Generate. Under Type, choose Random characters, Pronounceable or Passphrase (words).
2. Set the options. For characters, the Length slider runs from 8 to 64 and starts at 20. Tick Uppercase (A-Z), Lowercase (a-z), Digits (0-9) and Symbols (!@#$…) as the site you are signing up to allows. Tick Exclude ambiguous characters (I l 1 O 0 o) if you will ever read the password aloud or type it from paper. For a passphrase, set Number of words from 3 to 10, a Separator, and optionally Add a trailing digit.
3. Choose how many. How many passwords (1-20) lets you draw a batch and pick one.
4. Generate and copy. Tap Generate, then Copy next to the one you want. Regenerate draws a fresh set. Paste the result straight into a password manager.
5. Check an existing one. Switch to Check, then type or paste a password. You get a score from Very weak to Strong, an estimate under Time to crack (offline attack), and suggestions.

Because the generator makes the password, it never needs to see one you already use.

What to watch for

Randomness comes from the browser’s secure source, not Math.random. The tool uses crypto.getRandomValues, the browser’s cryptographic generator, and never Math.random, which is built for games and animation and is not safe for secrets. There is one more subtlety: mapping a random number onto a list can quietly favour some entries. If you take a 32-bit random number and compute the remainder after dividing by the list length, the first few entries come up slightly more often whenever the length does not divide evenly. The tool avoids this by rejection sampling. It works out the largest range that divides evenly, throws away any draw outside it, and draws again. Every character and word then has an equal chance.

Length does more work than complexity. With the tool’s letters, digits and symbols, each extra character multiplies the possibilities. A 20-character password from upper case, lower case and digits has roughly 119 bits of unpredictability, far beyond any realistic guessing effort. Adding a symbol class helps a little, but a longer length helps more. Some sites cap length or reject symbols, so tick only what the site accepts.

Passphrases are easier to live with. The word list is about 310 short common words, so each word adds about 8.3 bits. With the default of 4 words, that is roughly 33 bits, which is modest. Six words give about 50 bits and ten give about 83. If a passphrase is the thing you must remember, such as a password manager’s master password, choose six or more words and keep the separator. These figures count only the random draw, because the words come from a list and the attacker is assumed to know it.

Pronounceable is a trade. It is easier to say and type, but it carries less unpredictability per character than fully random characters. Make it longer to compensate.

The strength meter is an estimate. The score and the crack time come from a pattern-matching estimator. It looks for dictionary words, repeats and keyboard runs, and assumes an offline attack against a slowly hashed password. It cannot know how a given website stores passwords, whether the password leaked elsewhere, or whether a malware infection is watching you type. Treat “Strong” as a helpful sign, not a promise that nothing can break the password.

Never stored or sent. Nothing you type or generate is stored, logged or transmitted, and the tool has no history. If you use a shared link, it carries your settings only, never a password. When you close the tab the passwords are gone, so copy the one you will use into a password manager before you leave.

FAQ

How long should my password be?

For anything protecting money, email or a password manager, aim for at least 16 random characters, or six or more passphrase words. The tool starts at 20 characters and allows up to 64. Use the longest length a site accepts for accounts that matter, and keep a unique password for each.

Is a passphrase better than random characters?

Per character, random characters are denser, but a passphrase is much easier to type and remember. For a password you must memorise, use a longer passphrase. For one a password manager will store, use random characters and let the manager remember it.

Can I trust the “time to crack” figure?

Use it to compare two passwords, not as a forecast. It assumes one particular kind of attack and one rate of guessing. Real attackers, and real storage methods, vary, so a long, random password is the dependable part, and the number is only a rough guide.