What makes a password strong? Entropy, length, and randomness
Password strength is measurable. It comes from how many equally likely possibilities an attacker must search—entropy in bits—rather than from special characters squeezed into a predictable pattern.
How entropy is calculated
For a password built by picking characters uniformly at random from a
pool of N characters with length L, the entropy
is L × log₂(N). A 16-character password drawn from all four
common sets (about 89 symbols) carries roughly 104 bits of entropy.
Each additional character multiplies the search space. Doubling the pool size adds only one bit per character—which is why length is the cheapest way to buy strength.
Length beats cleverness
Approximate offline-cracking resistance for random passwords.
| Length | Entropy (all sets) | Assessment |
|---|---|---|
| 8 | ~52 bits | Crackable by serious offline attacks; acceptable only where forced |
| 12 | ~78 bits | Reasonable minimum for everyday accounts |
| 16–20 | ~104–130 bits | Strong default for password managers and primary credentials |
| 32+ | ~208+ bits | Overkill for humans, cheap for machines—ideal for master keys |
Practices that actually protect you
Use a CSPRNG
This tool draws from the Web Crypto API with rejection sampling, so every allowed character is equally likely—no modulo bias, no predictable patterns.
A password manager wins
Humans cannot remember dozens of unique random strings. A manager lets every account have its own strong credential.
Unique + MFA
Reused passwords turn one breach into many. Pair unique passwords with multi-factor authentication wherever it is offered.