Most people believe strong passwords mean adding exclamation marks and swapping letters for numbers. The reality is both simpler and more interesting: strength comes down to one thing — randomness.
What Attackers Actually Do
Forget the Hollywood image of a hacker guessing your password one letter at a time. Real attacks are automated:
- Credential stuffing — trying passwords leaked from other breaches (the most common attack)
- Dictionary attacks — testing millions of common passwords and variations, like
P@ssw0rd123 - Brute force — trying every combination, only practical for short or weak passwords
Modern cracking tools test billions of passwords per second against stolen hashes. A "clever" human-made password follows patterns, and patterns are exactly what these tools search for.
Entropy Is the Only Real Measure
Password strength is measured in entropy — the number of bits of randomness it contains. Each bit doubles the search space:
- A random 8-character password from all printable characters: ~52 bits
- A random 12-character password: ~78 bits
- A random 16-character password: ~104 bits
The key word is *random*. Tr0ub4dor&3 feels random but follows predictable substitution patterns, so its real entropy is far lower than its length suggests.
Length Beats Complexity
A famous xkcd comic illustrated this well. Compare:
Tr0ub4dor&3— 11 characters, pattern-based, maybe ~28 bits of real entropy- Four random common words like
correct horse battery staple— 28 characters, ~44 bits from word choice alone
Random words are easy for humans to remember and hard for machines to guess. The randomness must come from a generator, though — your favorite phrase is not random.
The Real Rules That Matter
- Never reuse passwords. A breach at one site exposes every account using the same password.
- Use a password manager. It generates and remembers truly random passwords for you.
- Enable two-factor authentication. Even a stolen password becomes far less useful.
- Length first. When in doubt, go longer, not more "complex."
- Check breach databases. Services like Have I Been Pwned tell you if your credentials have leaked.
Generating Passwords Safely
Any password generator that runs on a server sees your password. A browser-based generator uses your device's cryptographically secure random source (the Web Crypto API) and never transmits the result — the password exists only on your screen.
Try It Yourself
Generate a strong, random password right in your browser with our password generator — built on the Web Crypto API, fully offline, nothing ever sent anywhere.
No comments yet