How to generate a strong password (and why length beats symbols)

Length beats everything else

The strength of a password is measured in entropy — the number of possible passwords an attacker would have to try. Every character you add multiplies the search space by the size of your alphabet.

A 20-character password using just lowercase letters (26 possible characters) has about 94 bits of entropy — more than enough to resist any brute-force attack for the foreseeable future. A 10-character password using every printable ASCII character (95 possible) has only 66 bits — crackable by a well-funded attacker in weeks.

The lesson: length is the single biggest lever. A 20-character passphrase of common English words is stronger than an 8-character mix of upper, lower, digit, and symbol.

The symbol-requirement myth

Every website that demands "at least one uppercase letter, one number, and one symbol" is optimizing for the wrong thing. Those rules force users toward predictable patterns — capitalize the first letter, put the digit and symbol at the end (Password1!) — which reduces effective entropy rather than increasing it.

NIST officially dropped the composition-rule recommendation in 2017. Their current guidance: allow any characters, encourage length, and screen new passwords against known-breached lists. Most large services now follow this.

The three password patterns worth knowing

1. Generated random string, stored in a manager. Use a password manager (1Password, Bitwarden, Apple Passwords) to generate and remember 20-32 character random strings, one per site. You never type them; the manager fills them. This is the correct default for 2026.

2. Diceware passphrase. Six or seven random words from a wordlist (correct-horse-battery-staple-antelope-vinyl). Roughly 80-90 bits of entropy, easy to type, memorable. Good for the master password on your manager, or accounts you can't fill.

3. Modified base password. The unsafe pattern nearly everyone uses: one base password with the site name jammed in. Once one site leaks (they always do), attackers know your pattern.

Why the hash matters more than the password

Even the strongest password fails if the site stores it badly. When LinkedIn leaked in 2012, 6.5 million passwords were exposed as unsalted SHA-1 — a hash function fast enough to crack simple passwords in seconds. Sites that store passwords with bcrypt, argon2, or scrypt (all deliberately slow) survive breaches without exposing user credentials.

You can't control how a site stores your password, which is another reason for two habits: use a unique password per site (via a manager), and turn on 2FA anywhere sensitive. Then a leaked hash affects one account, not all of them, and even the leak itself doesn't hand attackers your account.

Generating passwords safely

Password Generator uses window.crypto.getRandomValues — the same cryptographically-secure random source browsers use for TLS keys. Not Math.random, which is deterministic enough that some early online generators produced predictable output.

Because generation is local, the password never touches a server. That matters because otherwise you're pasting the credential you're about to use into a system that theoretically saw it.

When you're stuck with a weak requirement

Sites that cap password length at 12 or 16 characters (yes, they exist — some banks are notorious for this) leave you no choice but to accept weaker entropy. Two mitigations:

• Use every character type they allow — if you can't add length, add variety.
• Turn on 2FA — a second factor makes even a weak password much harder to abuse.

Verifying hashes

If a site tells you the SHA-256 of your download or file should be a specific value, Hash Generator computes MD5, SHA-1, SHA-256, and SHA-512 locally in your browser via the Web Crypto API. You can paste the expected hash to verify a match in one step.

Related workflows:

• Base64 Encoder — for tokens and credentials passed over URLs.
• JWT Decoder — for auth tokens themselves.