Choosing and Judging a Strong Password

A long password built from a wide range of characters is exponentially harder to guess than a short one, even a short one that satisfies a typical 'must contain a number and a symbol' rule. Those rules exist mostly to nudge people away from the very weakest choices; they do not make a short password strong, they just make a weak one slightly less weak.

Entropy, measured in bits, describes how many possible passwords exist given a certain length and character set, and therefore how many guesses an attacker would need in the worst case. Each additional bit doubles the number of possibilities that have to be tried. This is why adding a few characters to a password does more for its real strength than swapping a letter for a similar looking symbol.

An entropy estimate based on length and character variety cannot tell whether a password is actually a real word, a well known pattern like a keyboard walk, or a password that has already appeared in a previous data breach. A password can score reasonably on pure entropy and still be a poor practical choice for reasons a simple calculation cannot detect.

If a password manager is generating and remembering the password for you, memorability stops being a constraint entirely, and there is no reason not to use a long, fully random password for every single account. The habit of choosing memorable-but-guessable passwords exists specifically because people used to have to remember them; a manager removes that tradeoff completely.

Password Generator creates a random password from whichever character types you choose using your browser's cryptographically secure random number generator, and Password Strength Checker estimates the entropy of any password you type, checked entirely in your browser and never sent anywhere. Try generating a 12 character and a 20 character password and compare the estimated entropy between them.