What makes a password strong
Two things, and only two: length, and unpredictability. Everything else — the substituted characters, the exclamation mark on the end, the capital letter at the front — is decoration that attackers have accounted for since the early 2000s.
The [msm_tool slug="password-generator"] builds passwords from an 88-character set covering lowercase, uppercase, digits and symbols, using your browser's cryptographic random number generator. Each character therefore carries about 6.5 bits of entropy, which puts a 16-character password at roughly 103 bits. For context, a password with 80 bits of entropy is already far beyond brute-force reach with current hardware; 103 bits leaves a substantial margin against future improvement.
The passwords are generated on your device. Nothing is transmitted, logged or stored, and no password ever exists anywhere except in your browser tab. That is not a claim you can verify on most generator sites, and it is worth caring about — a password sent to a server for generation has, by definition, already been shared with someone.
Why "P@ssw0rd!" is not a strong password
Character substitution feels like it should help. It does not, because password cracking software applies exactly these substitutions automatically. A cracking rule set will try a→@, o→0, i→1, s→$, capitalise the first letter and append digits and punctuation, all as standard transformations of dictionary words.
The result is that a password built by decorating a real word is only marginally harder to crack than the word itself. What defeats cracking is the absence of any pattern to exploit — which is precisely what random generation provides and human invention does not.
How long should a password be?
| Length |
Approximate entropy |
Suitable for |
| 8 characters | ~52 bits | Minimum many sites accept; not adequate for anything valuable |
| 12 characters | ~78 bits | Reasonable for ordinary accounts |
| 16 characters | ~103 bits | A sensible default for everything |
| 24+ characters | ~155 bits | Password manager master password, encryption keys, root accounts |
Since a password manager does the typing, there is very little reason to choose a short one. Use 16 as your floor and go longer wherever the site permits it.
The rule that matters more than strength
Never reuse a password across sites.
This matters more than length because of how breaches actually play out. When a service is compromised, the stolen credentials are fed into automated login attempts against every other major service — a technique called credential stuffing. A perfectly strong password that you have used in two places offers no protection at all once one of those places is breached. A weak but unique password at least confines the damage to one account.
Unique passwords everywhere is impossible to do from memory, which is the entire argument for using a password manager. Generate, store, never memorise, never reuse.
Where to keep generated passwords
A password manager is the only practical answer once you have more than a handful of accounts. Bitwarden, 1Password and KeePassXC are all well regarded, and browsers now include competent built-in managers. You memorise exactly one long passphrase — the master password — and the manager handles everything else.
For that one master password, a passphrase of four or five random words is easier to type and remember than a random string, and remains strong provided the words are genuinely chosen at random rather than composed into a sentence you invented.
Turn on two-factor authentication
A strong password protects against guessing. It does not protect against a convincing phishing page, malware on your machine, or a breach at the service itself. Two-factor authentication does, because the stolen password alone is no longer sufficient.
Prefer an authenticator app or a hardware security key over SMS codes. SMS is better than nothing but is vulnerable to SIM-swapping, where an attacker persuades a mobile network to move your number to their device.