“Replace the a's with @ and add an exclamation mark”: that old advice no longer stands up to today's attack tools. A password's strength can be measured and calculated, and depends less on writing tricks than on how random and how unique it is. This guide gives the orders of magnitude, the good habits and the limits of each check.
Measuring in bits of entropy
Entropy, expressed in bits, measures the amount of uncertainty: each extra bit doubles the number of guesses needed to find the password. For a truly random password, it equals length × log₂(alphabet size).
| Password | Calculation | Entropy | At 10¹² guesses per second* |
|---|---|---|---|
| 8 lowercase letters | 8 × log₂(26) | ≈ 37.6 bits | ≈ 0.2 second |
| 12 characters from 94 | 12 × log₂(94) | ≈ 78.7 bits | ≈ 15,000 years |
| 16 characters from 94 | 16 × log₂(94) | ≈ 104.9 bits | Out of reach |
| 6-word phrase (1,000-word list) | 6 × log₂(1,000) | ≈ 59.8 bits | ≈ 12 days |
| 8-word phrase (1,000-word list) | 8 × log₂(1,000) | ≈ 79.7 bits | ≈ 32,000 years |
*An extreme, theoretical assumption: an attacker holding a database of fast fingerprints (see MD5, SHA-256 and bcrypt hashes: verifying a file, storing a password) and very powerful hardware. On average a guess succeeds after half the space. The durations are orders of magnitude; they mainly illustrate the huge gap between 38 and 80 bits.
Generating a password with Password Generator
- Choose the length (8 to 128 characters) and the character sets you want: lowercase, uppercase, digits, symbols.
- The tool draws each character with your browser's secure random generator, rejecting values that would skew the distribution: every character has exactly the same chance of coming up. At least one character from each ticked set is guaranteed.
- “Exclude look-alike characters” removes I, l, 1, O and 0, easy to confuse when reading or dictating.
- Read the entropy shown and aim for at least 80 bits for an important account.
- Copy the result into your password manager: nothing is sent or saved, and it disappears when you leave the page.
A passphrase (words drawn at random from a list of over 1,000 words) is far easier to remember than a string of symbols. Mind the length: 6 words give only 59.8 bits, enough for an account on a site that limits attempts, but fragile against a fast offline attack; count on 8 words (79.7 bits) for your manager's or your computer's password, which you have to type by hand.
Practical rules
- One unique password per account. An excellent password reused on ten sites is exposed at the first leak.
- Use a password manager to remember a single strong secret (a passphrase) and let the manager produce the rest.
- Turn on two-factor authentication wherever possible, preferably by app or hardware key rather than SMS.
- Never share a password by email or messaging; change it if it has been exposed.
- Do not force regular changes for no reason: changing every quarter pushes people to choose weaker ones. Change on a leak or a doubt.
Common mistakes
- Trusting a complicated look (“P@ssw0rd!”): attackers try these substitutions first.
- Using a birth date, a first name, a pet's or a team's name.
- Varying the same password from site to site by adding the site's name.
- Choosing a short password because “the site is unimportant”: it is often the way into your mailbox.
- Forgetting the password manager's recovery code.
Honest limits
- Crack durations depend on assumptions about the attacker's hardware and how the site stores passwords: they are orders of magnitude.
- An excellent password does not protect against phishing or spyware.
- The breach check needs an internet connection and may be rate-limited by the service; the tool then shows how long to wait.
Frequently asked questions
What length should I choose?
At least 12 random characters, 16 for an important account. With a passphrase drawn from a 1,000-word list, aim for 8 words drawn at random.
Are generated passwords saved?
No. They are created in your browser and disappear when you leave the page: copy them into your manager.
Is my password sent to check for a breach?
No. Only the first five characters of the SHA-1 fingerprint are transmitted; the final comparison happens on your device.
Is a passphrase safer than a password?
For memorisation, yes at equal entropy. For strength, it all depends on the number of words and their randomness: a well-known quotation is weak.
Should I change my passwords regularly?
Not without a reason. Change them on a leak, a suspicion or accidental sharing, and keep them unique.