ToolSite
All posts

How to Generate Strong Passwords (Length Wins)

Learn why password length matters more than complexity, how entropy works, and how to generate truly strong passwords. Try our free password generator tool.

By ToolSite6 min readguides

Why Most Password Advice Is Wrong

For years, users have been told to create passwords with uppercase letters, lowercase letters, numbers, and symbols, and to change them every 90 days. This advice is outdated and counterproductive.

Complexity rules lead to predictable patterns: Password1!, Summer2024!, Myname@123. Password crackers know these patterns and try them first because they match exactly what complexity policies force humans to produce. Length is a far stronger defense than forced complexity.

NIST's current guidelines (SP 800-63B) recommend:

  • Minimum 8 characters for user-generated passwords, 15+ preferred
  • No mandatory character-composition rules (no "must include uppercase")
  • Check new passwords against known breached password lists
  • Only force changes when there is evidence of compromise
  • Encourage passphrases over complex short passwords

The UK's NCSC and Australia's ACSC publish similar guidance. The industry consensus has shifted: length and uniqueness beat complexity.

Entropy in Plain Terms

Entropy measures unpredictability. In password terms, higher entropy means more guesses required to crack it. Every additional bit of entropy doubles the attacker's work.

The formula:

entropy (bits) = log2(character_set_size^length)
               = length x log2(character_set_size)

Character-set sizes:

  • Digits only (0-9): 10
  • Lowercase letters (a-z): 26
  • Upper + lower: 52
  • Upper + lower + digits: 62
  • Upper + lower + digits + common symbols: ~95

A 12-character password using only lowercase letters has:

12 x log2(26) ≈ 12 x 4.7 ≈ 56 bits of entropy

A 12-character password using mixed case, digits, and symbols has:

12 x log2(95) ≈ 12 x 6.6 ≈ 79 bits

But an 8-character password with maximum complexity has:

8 x log2(95) ≈ 8 x 6.6 ≈ 53 bits

Even with full symbol sets, the short password is weaker than the longer one with no complexity at all.

Length vs Complexity: Why Length Wins

The character-set multiplier (log2(set_size)) adds at most a factor of about 1.6 when you go from 26 to 95 characters. But length multiplies the entire exponent. Adding a single character to a lowercase-only password adds 4.7 bits. Switching from lowercase-only to full mixed adds only 1.9 bits per character.

A 16-character all-lowercase passphrase like correct-horse-battery-staple (the xkcd example) has roughly:

25 x log2(27) ≈ 25 x 4.75 ≈ 119 bits of entropy

That is stronger than any 8-character password with full complexity, and far easier to type and remember. The xkcd comic is not a joke. It is accurate math packaged as a stick figure drawing.

The practical attack model matters too. If an attacker gets your bcrypt hash from a breach, they try dictionary words, common substitutions (@ for a, 3 for e), and leaked password lists before they try brute force. A passphrase of four random words chosen from a 7,000-word dictionary has about 51 bits of entropy. That is enough to make offline cracking expensive if the hash function is bcrypt or Argon2 with appropriate work factors.

How Password Generators Work

A password generator produces random strings from a configurable set of characters. The key ingredient is a cryptographically secure random source, not a predictable PRNG like Math.random().

A good generator lets you control:

  • Length: the single most important factor. 16 is a reasonable minimum. 20 is better. For a password manager master password, 25+.
  • Character sets: uppercase, lowercase, digits, symbols. More is mildly better, but length dominates.
  • Exclude ambiguous characters: 0 vs O, 1 vs l vs I, 5 vs S. These cause support tickets when users misread generated passwords.
  • Avoid sequential characters: some generators avoid runs like abc or 123 that look non-random to users and trigger false positives in strength checkers.

The password strength meters you see on websites are often misleading. They reward complexity rules that do not meaningfully increase entropy. Measure strength by length and source quality, not by the green bar filling up.

How Servers Store Your Password (and What to Look For)

Servers should never store your actual password. They store a hash computed by a slow, memory-hard password hashing function:

  • bcrypt: the established choice. Built into most frameworks. Configurable via a cost factor (higher = slower).
  • scrypt: like bcrypt but memory-hard. Resistant to GPU and ASIC attacks because it requires significant RAM per hash.
  • Argon2: winner of the 2015 Password Hashing Competition. Memory-hard, configurable, and generally considered the best choice for new systems. Argon2id is the recommended variant.

These are deliberately slow. A single bcrypt hash at cost factor 12 takes about 250ms on a modern CPU. That means an attacker can try about 4 passwords per second per core, not billions.

Raw hash functions like MD5 and SHA-256 are completely wrong for passwords. They are designed to be fast. A modern GPU can compute tens of billions of SHA-256 hashes per second. If a database of SHA-256-hashed passwords leaks, most of them will be cracked within hours using commodity hardware and dictionary attacks.

If a service can email you your plaintext password when you click "forgot password," they are storing your password in plaintext or with reversible encryption. Stop using that service.

Storing Passwords on Your Side

Once you have a strong password, the next question is how to store it:

  • Use a password manager: it generates, stores, and auto-fills unique passwords for every site. Password reuse is the biggest real-world weakness. One breach at a poorly secured forum exposes your email/banking password.
  • Never reuse passwords across accounts: each account gets its own unique password. A password manager makes this practical.
  • Use a strong master password for your password manager: this is the one password you must memorize. Make it long. A passphrase of 5+ random words is both strong and memorable.
  • Enable two-factor authentication: even if your password leaks, TOTP, passkeys, or hardware security keys add an independent layer. A stolen password alone is not enough to log in.
  • Never store passwords in plain text: if you must write one down, use an encrypted vault, a hardware token, or a sealed envelope in a safe. Not a sticky note on your monitor.

Try it yourself: open the Password Generator, set the length to 20, enable uppercase, lowercase, digits, and symbols, and click Generate. Copy the result. Then reduce the length to 8 and generate another. The 20-character password is exponentially stronger regardless of what characters each one uses. Count the characters in each and run the entropy formula mentally. You can also verify the uniqueness by pasting both into the Hash Calculator. Even one character difference produces an entirely different SHA-256 digest.

Related Reading