How to make a strong password: length, characters and entropy

The strength of a password is fixed at the moment it is made. A random password of a given length is as strong as the number of passwords it could have been, and nothing about its appearance changes that. A password a person invented is as strong as the guesses an attacker has to make before reaching it, and attackers are very good at guessing what people invent.

That makes the practical question simple: how many possible passwords did yours come from? The rest of this article is about turning that into a number, and about the few settings that move it.

Strength comes from how it was made

Invented passwords follow patterns, and the patterns are well known. A word, a capital letter at the front, a year or a number at the end, a symbol to satisfy the rules, letters swapped for look-alike digits. Cracking tools do not try every combination in order. They start with dictionaries, leaked password lists and exactly these transformations, which is why a password that looks complicated can fall early.

A random password has no pattern to start from. Every character was chosen independently, so the only way to find it is to work through the possibilities, and with enough of them that stops being feasible.

Entropy, the number that matters

Entropy is that count of possibilities, expressed in bits. For a random password it is the length multiplied by the bits each character carries, and each character carries the base-2 logarithm of how many characters it could have been:

• Digits only: 10 characters, about 3.3 bits each.
• Lowercase letters: 26 characters, about 4.7 bits each.
• Letters and digits: 62 characters, about 5.95 bits each.
• Letters, digits and symbols: 90 characters in our generator, about 6.49 bits each.

Twenty characters from the full set comes to about 130 bits. Twelve comes to about 78. Every additional bit doubles the number of guesses needed, so 130 bits is not twice as strong as 65, it is a number with twenty digits times stronger.

The password generator shows the entropy of your settings as you change them, and it assumes the attacker knows those settings. That is the honest way to measure it: the strength has to come from the randomness, not from the attacker not knowing which boxes you ticked. It labels anything under 45 bits weak, 45 fair, 70 strong and 100 very strong.

How long it should be

• Twenty characters is the default and a sensible one for anything stored in a password manager.
• Sixteen is a reasonable minimum for accounts that matter.
• Twelve is the floor, for systems that will not accept more.
• Longer costs nothing when software fills it in, up to whatever maximum the site allows.

Length beats variety. One extra character adds about 6.5 bits. Switching on symbols for a twenty-character password of letters and digits adds about 11, which two extra characters would have bought anyway.

Which characters to include

Use all four sets unless a system refuses some of them. If it does, switch those off and add a couple of characters to make up the difference.

A few symbols are left out of our generator on purpose: quotes, the backslash, the backtick and the space. Each needs escaping in a shell command, a .env file or JSON, which is exactly where generated passwords tend to end up. A password that breaks a config file usually gets replaced with something weaker by someone in a hurry, so leaving these out keeps the strong one in place.

Many systems insist on at least one digit, one capital and so on. The generator guarantees every set you switch on appears at least once. It does this by throwing away any password that misses a set and drawing a fresh one, rather than patching a digit into a fixed position, which would make that position predictable.

Look-alike characters

Some characters are easy to confuse on a screen or when read aloud: capital I, lowercase l, the digit 1 and the vertical bar, and capital O, the digit 0 and lowercase o. Turn on the option to avoid them for anything a person has to type by hand, such as a WiFi password, a router admin login or a printed onboarding sheet.

It costs a little strength per character, because the set shrinks from 90 characters to 83. Twenty characters still come to about 127 bits, and the figure on screen accounts for it.

Where the randomness comes from

The ordinary random function in a browser is built for games and animations, not secrets. Browsers also provide a cryptographic random number generator, and that is the one our generator uses for every character.

Using it correctly matters too. The naive way to turn a random byte into one of 90 characters is to take the remainder after dividing by 90. Because 256 does not divide evenly by 90, that makes 76 of the characters half as likely again as the other 14. The generator avoids this by discarding any random number that falls in the uneven remainder and drawing again, so every character is exactly as likely as every other.

Generating makes no network request. The password exists only in your browser tab until you copy it.

What to do with it next

• Store it in a password manager. That is what makes length free, and it means the password never needs to be memorable.
• If someone else needs it, send it once. Pasting it into a chat or an email leaves it readable for years. A one-time link shows it once and then deletes it, and the generator can hand the password straight to one.
• Send the username separately. Neither half is much use alone, which is the everyday version of out-of-band delivery.

For something a person has to type or say rather than paste, a passphrase is usually the better choice.