What makes a password hard to guess is how many possibilities an attacker has to try. Two things matter: the length and whether the characters were chosen randomly. Cleverness, like replacing "a" with "@", adds very little because attackers try those substitutions first.
Strength in bits
A password chosen uniformly at random from an alphabet of N symbols has length x log2(N) bits of entropy. For example:
- 12 random letters and digits (62 symbols): about 71 bits.
- 16 random characters from letters, digits and symbols (about 94 symbols): about 105 bits.
- 20 random characters from the same set: about 131 bits.
- Four random common words from a large list is easy to remember and strong, if the words are truly picked at random, not chosen by you.
Each extra bit doubles the work for an attacker. Beyond roughly 80 bits, guessing online is not realistic for a random password, though the number that matters also depends on how the site stores it and whether it has been leaked.
The bigger risks
- Reuse. If one site is breached, attackers try the same e-mail and password everywhere. A unique password per site limits the damage.
- Phishing. A perfect password does not help if you type it into a fake page.
- Weak storage on the service side, which you cannot control.
Practical advice
- Use a password manager so every account gets a long, random, unique password and you only remember one strong master passphrase.
- Aim for at least 16 characters for important accounts. Many sites allow far more.
- Turn on two-factor authentication, preferably with an authenticator app or a security key.
- Do not rely on rules like "must contain a symbol"; length helps more.
Our generator picks characters with your browser's cryptographically secure random generator, uses unbiased selection, and never stores or sends the result. The strength gauge is a quick guide based on length and variety, not a guarantee.