What the strength number actually means
The figure shown is entropy in bits — a measure of how many guesses an attacker would need on average. Each additional bit doubles that number. A 40-bit password takes about a trillion guesses to exhaust; a 60-bit password takes a million times more.
Entropy is calculated from the size of the character set and the length, not from whether the result looks complicated. This is why Tr0ub4dor&3 is weaker than it appears and a five-word passphrase is stronger than it appears. Substituting @ for a adds almost nothing, because attackers' tools have applied those substitutions for decades.
The crack time assumes an offline attack at 100 billion guesses per second against a well-built hash — a plausible rate for a determined attacker with modern GPUs. If a site stores passwords badly, real times are far shorter, which is another argument for length.
Random characters or a passphrase?
- Random characters pack the most entropy into the fewest characters. Use them for anything a password manager will remember on your behalf, which should be almost everything.
- Passphrases are for the handful you must type from memory — your device login, your password manager's own master password. Five random words from a large list is around 64 bits, comfortably strong, and you can actually remember it.
The important word is random. A phrase you chose yourself carries a fraction of the entropy of one a generator picked, because human word choice clusters heavily around common and related words.
Length beats complexity
If you take one thing away: adding characters helps far more than adding character types. Going from 12 to 16 lowercase letters gains more entropy than adding symbols to a 12-character password. Many services still enforce complexity rules that push people toward short passwords with predictable substitutions — meet the rule, then keep making it longer.
Practical habits that matter more than the password
- Never reuse a password across sites. Reuse is how a breach at one service becomes a breach at all of them, regardless of strength.
- Use a password manager. It removes the need to remember or type anything, which is what makes long random passwords practical.
- Turn on two-factor authentication where offered. It protects you even if the password is exposed.
- Prioritise your email account. Whoever controls it can reset most of your other passwords.
Frequently asked questions
Is the password sent anywhere?
No. Generation uses your browser's built-in cryptographic random function locally. Nothing is transmitted, logged or stored, and closing the tab discards it.
Is this randomness good enough for real security?
Yes. It uses crypto.getRandomValues, the browser's cryptographically secure generator — the same class of source used by security software. It is not the predictable Math.random.
How long should my password be?
Sixteen characters or more for anything stored in a password manager. For passwords you type from memory, use a passphrase of at least five random words.
Should I change passwords regularly?
Current guidance says no, unless you have reason to think one was exposed. Forced rotation tends to push people toward weaker, predictable variations of the same password.