What actually makes a password strong
Most advice about passwords focuses on the wrong lever. Swapping an "a" for an "@" or adding an exclamation point at the end feels like it's adding security, but cracking tools have known about those substitutions for years. They're built into the standard wordlists and rule sets attackers use, so a password like P@ssw0rd! gets tested almost as fast as password. The substitution trick stopped being clever the moment it became common enough to script.
What actually matters is length. A long random passphrase, something like four or five unrelated words strung together, beats a short "complex" password every time, because length is what forces an attacker's cracking tool to work through exponentially more possibilities. Complexity tricks add a little friction. Length adds an enormous amount.
Think about it from the attacker's side. A cracking tool isn't guessing blindly, it's working through a search space, often starting with dictionary words, then common variations, then patterns humans tend to fall back on: a capital letter at the start, a number at the end, a symbol somewhere in between. Every one of those habits is already accounted for. The only variable those tools genuinely struggle with is raw, unpredictable length.
This is why security guidance has shifted over the past decade. It used to be "eight characters, one number, one symbol." Now it's closer to "the longer the better, and don't bother trying to be clever about substitutions." A passphrase like correct-horse-battery-staple style strings, four or five random unrelated words, is both easier for a human to remember and dramatically harder for software to guess than something like Tr0ub4dor&3.
None of this means complexity is useless. Mixing character types still adds some difficulty. It just means complexity without length is a weak trade, and people consistently overinvest in the wrong one.
Entropy, explained without the math
You'll see the word entropy come up whenever password strength is discussed seriously. Skip the formulas. The practical idea is simple: more possible characters at each position, and more positions overall, means exponentially more combinations an attacker has to guess through before landing on the right one.
"Exponentially" is doing real work in that sentence, and it's worth sitting with for a second. Adding one more character to a password doesn't add a little more security, it multiplies the total number of possible combinations by however many characters are available at each position. That compounding effect is why length outperforms complexity so decisively: a password that's a few characters longer can have vastly more possible combinations than one that's shorter but uses a wider character set.
Here's what that looks like in practice:
- An 8-character password, even a "complex" one with mixed case, numbers, and symbols, has a relatively small number of possible combinations by modern cracking standards. Specialized hardware, the kind attackers use against stolen password hash databases, can work through that entire space in a short amount of time, sometimes hours.
- A 16-character random password sits in a completely different universe of possibilities. Each additional character doesn't just add a little difficulty, it multiplies the total number of combinations that exist, pushing the time required to exhaust that search space from hours into a timeframe that's effectively meaningless to plan around.
This is also why password strength meters that reward you for adding a symbol but not for adding four extra characters are giving slightly misleading feedback. They're not wrong that symbols help, but they usually understate how much more length alone would help.
That's the whole concept. You don't need to calculate entropy in bits to use it. You just need to remember that length beats cleverness, every time, and that a longer random password is disproportionately harder to brute-force than a shorter one, "complex" or not.
Why the real danger isn't weak passwords, it's reused ones
Here's the part most password advice skips. Most account breaches don't happen because someone sat there guessing a password character by character. They happen because a password leaked in one breach, maybe an old forum or a shopping site you forgot you signed up for, gets tried again automatically on hundreds of other sites. This is called credential stuffing, and it's the source of the overwhelming majority of account takeovers.
The mechanics are almost boring compared to how much damage they cause. A breached website's user database leaks, often with poorly protected or unencrypted passwords. That combination of email address and password gets added to a list, and automated tools quietly try that exact pairing against banks, email providers, social media platforms, and anywhere else the same email might have an account. No guessing involved, no brute force, just a login attempt with credentials that already worked somewhere once.
That means a genuinely strong password can still get you breached, if you use it in more than one place. A 20-character random password reused across your email, your bank, and a random shopping account is only as safe as the weakest of those three sites. If that shopping site gets breached, an attacker now has your strong password and simply tries it everywhere else you might use it, starting with your email, since email access often unlocks password resets for everything else.
This is why "strong" and "safe" aren't the same thing. A password can score perfectly on every strength meter and still be the reason an account gets taken over, if it's shared with even one other login somewhere on the internet.
A strong-but-reused password is still a serious risk. Strength protects against guessing. Uniqueness protects against leaks. You need both.
Why a password manager is the actual fix
Once you accept that every account needs its own unique, strong password, a problem shows up immediately: no one can memorize 50 different 16-character random strings. Trying leads to one of two outcomes, either weak passwords that are easy to remember, or the same strong password reused everywhere, which brings back the exact problem described above. Neither outcome is acceptable once you know what's actually at stake.
A password manager solves this by taking memorization out of the equation entirely. It generates a random, strong, unique password for every site, stores it encrypted, and fills it in when you need it. You only need to remember one master password, plus whatever second factor protects the manager itself. If one site you use gets breached, that leaked password is useless anywhere else, because it was never used anywhere else. The blast radius of any single breach shrinks down to just that one account.
There's also a practical side benefit that gets overlooked: a password manager makes it trivial to actually use long, random passwords everywhere, because you never have to type or remember them. Once generating and storing a password is effortless, there's no reason to fall back on a memorable-but-weak pattern ever again.
- It removes the memorization tax. You stop having to choose between security and convenience, because the manager handles both.
- It contains breaches. A leak on one site stays isolated to that one site instead of cascading into your email, bank, or work accounts.
- It nudges you toward better habits automatically. Autofill only works when a password is stored correctly, which quietly discourages the kind of reuse that causes most damage.
This is the actual fix. Strong passwords matter, but a strong password strategy only works at scale with something storing and generating them for you. Generating one good password is a five-second task. Generating and remembering fifty of them without help is not realistic for anyone.
Generating a strong password right now
If you need a strong password immediately, our own free Password Generator creates a random, strong password directly in your browser, with adjustable length and character sets. It's free, unlimited to use, and nothing is ever uploaded to a server, the password is generated locally on your device.
Adjustable length matters here for exactly the reason covered above: a site that only allows 12 characters still deserves a fully random 12-character password rather than a shorter memorable one, and a site with no length limit is a good place to push toward 20 characters or more. Adjustable character sets matter too, since some login forms reject certain symbols, and being able to turn those off avoids the frustration of a generated password getting rejected at signup.
That said, generating a strong password is only half the job. Once you have it, it still needs somewhere safe to live rather than a sticky note, a browser autofill you never audit, or a reused mental pattern. Pair a generated password with a password manager for storage, and you've covered both halves of the problem: strength and uniqueness. Generate it here, save it there, and move on to the next account without ever having to remember the result.