How to Create a Strong Password (Length Beats Complexity)
A strong password is long, random, and never reused. Length matters more than complexity: an 8-character password with every character type turned on cracks in days, while a 16-character password of the same mix would take longer than the age of the universe at current attack speeds.
Why length beats complexity
Password strength comes down to entropy, the number of guesses an attacker needs on average before hitting the right one. Entropy depends on two things: how many possible characters exist at each position (the charset), and how many positions there are (the length).
Adding a character type barely moves the charset. Lowercase letters alone give you 26 options per character. Add uppercase and digits and you’re at 62. Add symbols and you reach roughly 95. Going from lowercase-only to the full 95-character set multiplies your options per position by about 3.7x.
Adding one more character to the length, by contrast, multiplies the total number of combinations by the full charset size, not just 3.7x. A 95-character charset means each extra character multiplies total combinations by 95. That’s why a longer password with a smaller charset can beat a shorter one with every symbol enabled: length compounds, complexity per character does not.
Worked example: crack time by length and charset
The table below assumes an attacker running 10 billion guesses per second, a realistic budget for a modern GPU cracking rig against an offline copy of hashed passwords. Guessing is assumed to average half the total keyspace.
| Length | Lowercase only (26 chars) | Full mix: upper + lower + digits + symbols (95 chars) |
|---|---|---|
| 8 | 10.4 seconds | 3.8 days |
| 10 | 2.0 hours | 94.9 years |
| 12 | 1.8 months | 8,567 centuries |
| 16 | 691 centuries | 697.8 billion centuries |
Two things jump out. First, an 8-character password is never safe against offline cracking, even with every character type enabled: 3.8 days is well within reach for anyone who wants your account badly enough. Second, going from 12 to 16 characters in the full charset doesn’t just help, it moves the password from “crackable this century” to a number with no practical meaning as a timeframe.
The math behind the table: entropy in bits is length × log2(charset size). A 16-character password using all four character types has 16 × log2(95) ≈ 105 bits of entropy. Each additional bit doubles the number of guesses required, so entropy climbs fast once length increases.
Generate a strong password
Pick a length of 16 or higher and leave all four character types checked for maximum entropy per character. The password is generated in your browser using the Web Crypto API; nothing is sent to a server.
Common mistakes
Predictable substitutions. Swapping “a” for ”@” or “o” for “0” in a dictionary word barely raises entropy, because cracking tools already test these substitutions as standard rules against every word in their dictionaries. “P@ssw0rd1” is cracked about as fast as “password1”.
Reusing a strong password across sites. A single strong password used on ten different sites is only as safe as the weakest of those ten. Once one site suffers a data breach, credential-stuffing bots try that same email and password combination against banks, email providers, and social media accounts within hours. A unique password per site, generated fresh, contains the damage to a single account.
Meeting the minimum instead of the maximum. Many sites require “at least 8 characters, one number, one symbol.” That’s a floor, not a target. An 8-character password that just clears the requirement can still fall in days against offline cracking, as the table above shows. Treat 16 characters as the practical minimum for anything you’d mind losing.
Storing passwords nowhere except memory. Trying to memorize a dozen unique 16-character random strings leads most people back to weak, reused, or slightly-varied passwords. A password manager solves this by generating and storing a unique strong password per site, so you only need to remember one master password.
Frequently Asked Questions
Is a 20-character password with only letters and numbers safer than a 10-character password with symbols? Yes, by a wide margin. Length dominates the entropy formula. A 20-character alphanumeric password has roughly 119 bits of entropy versus about 66 bits for a 10-character password using the full symbol set, a difference of about 9 quadrillion times more possible combinations.
How often should I change a strong, unique password? If it was generated randomly, is unique to that one account, and there’s no evidence of a breach, there’s no security benefit to rotating it on a schedule. Change a password immediately if the service reports a breach, if you reused it elsewhere before generating a unique one, or if you suspect it was exposed (phishing, shoulder surfing, a compromised device).
Are online password generators safe to use? It depends on where the generation happens. This tool generates the password entirely in your browser with the Web Crypto API’s cryptographically secure random number generator; the password is never transmitted anywhere, so there’s nothing for a server to log or leak. Avoid generators that create the password server-side and only display it to you afterward.
What’s a passphrase, and is it better than a random password? A passphrase strings together several random, unrelated words (like the diceware method) instead of random characters. A four-word passphrase from a large wordlist can reach 40-50+ bits of entropy while being far easier to type and remember than an equivalent random string. It’s a good option for a memorable master password, such as the one protecting a password manager; for every other account, a generated random password stored in that manager is simpler and stronger for a given length.