Password strength is mostly length — here's the math

Password rules obsess over symbols and capitals, but the quantity that decides whether a password survives a cracking rig is entropy — how many guesses an attacker needs — and entropy is mostly about length.

Counting guesses

If each character is chosen randomly from an alphabet of A characters, a password of length L has A^L possibilities, or L × log₂(A) bits of entropy:

• Lowercase only (26): about 4.7 bits per character.
• Letters + digits (62): about 5.95 bits per character.
• All printable characters (95): about 6.6 bits per character.

When criminals steal a database and crack it offline, rigs guess on the order of 10 billion per second. At that speed:

1. 8 lowercase characters (37.6 bits, ~2×10¹¹ guesses): gone in under a minute.
2. 12 lowercase characters (56.4 bits): a few months of machine time.
3. 16 random mixed characters (~105 bits): about 10²¹ seconds — trillions of years. Effectively never.

Notice what happened: doubling the length did overwhelmingly more than adding symbols ever could. Length compounds; complexity decorates.

The catch: it only counts if it's random

These numbers assume every character is chosen by chance. Summer2026! is long-ish but attackers try dictionary words, years and the trailing-! pattern first — its real search space is tiny. Human-made "random" isn't. Use a generator, or use random words: a passphrase of 5–6 random words from a large wordlist (like correct horse battery staple grape) carries 65–78 bits and is actually typeable and memorable.

What matters even more than strength

1. Unique per site. Most account takeovers aren't cracking at all — they're a password stolen from one breached site replayed on your email and bank. One password, one site, always.
2. A password manager makes unique + random practical: you memorize one strong passphrase and it holds the rest.
3. Two-factor turns even a stolen password into a partial key.

The free Password Generator runs entirely on your device — the password appears in your browser and never travels anywhere. Generate a long one, store it in your manager, and stop hand-crafting "clever" ones: the math doesn't reward clever, it rewards long and random.