How Strong Does a Password Need to Be? Cracking, Entropy, and What Actually Works

The average leaked password is eight characters, contains a word, and ends in a number or an exclamation mark. Attackers know this, which is why cracking tools do not start with random guesses; they start with dictionaries, common substitutions (a → @), and every password that has ever appeared in a breach. A password that looks clever to you was probably tried in the first second. This guide explains how passwords actually get broken, what “strong” means in numbers, and how to generate and manage passwords you will never have to remember.

How passwords are cracked

Almost nobody guesses your password by typing at a login screen; rate limits make that impractical. Instead:

1. A service is breached and its database of hashed passwords leaks.
2. Attackers hash billions of candidates on GPUs and compare. A single modern graphics card tests tens of billions of MD5 hashes per second, and hundreds of millions of bcrypt hashes per day. Weak hashing makes everything below fast; strong hashing slows it, but does not make a weak password safe.
3. The candidates come from lists, not randomness: previous breaches (billions of real passwords), dictionaries in every language, names, dates, keyboard walks (qwerty, 1q2w3e), and rules that mutate them (capitalise first letter, append 123, swap o for 0).
4. Cracked passwords are then tried on other sites (“credential stuffing”), which is why reuse is the real danger: one weak site exposes every account that shares the password.

Strength is entropy, not complexity

Entropy measures how many equally likely possibilities a password was drawn from, in bits. Each extra bit doubles the number of guesses needed. Roughly:

Advertisement

Password style	Entropy	Time to crack (fast hash, GPU cluster)
Summer2024! — word + year + symbol	~20–25 bits	Instant (it is in the wordlist)
8 random lowercase letters	~38 bits	Minutes
10 random mixed case + digits	~60 bits	Months
14 random mixed case + digits + symbols	~90 bits	Beyond any current hardware
4 random dictionary words (passphrase)	~50 bits	Years
6 random dictionary words	~77 bits	Centuries

The key word in every strong row is random. Complexity rules (“must contain a symbol”) add almost nothing when people satisfy them predictably. Length with genuine randomness is what moves the number. The Password Generator shows the entropy estimate for each password it creates, so you can see the effect of length and character set directly.

What “random” requires

Randomness has to come from a cryptographic source, not from a person. Humans asked to “pick random characters” cluster on the home row and avoid repeats, and their output is far more guessable than it looks. A generator should use the operating system’s or browser’s cryptographic random number generator (crypto.getRandomValues() in the browser), which is what the tool above uses. It runs entirely on your device; the password is never transmitted or logged.

Recommended settings by use

• Anything stored in a password manager: 20+ characters, all four character classes. You will never type it, so length is free.
• Passwords you must type occasionally (laptop login, Wi-Fi): a 5–6 word passphrase. Easier to enter on a phone or TV than 16 random symbols and just as strong.
• Master password for the manager itself: a 6+ word passphrase you have memorised, and nothing else uses it.
• Sites with stupid rules (max 12 characters, no symbols): use the generator’s options to fit, and treat that account as lower trust.

Use the “exclude ambiguous characters” option when a password will be read aloud or copied from a screen; it removes l/1/I and O/0 lookalikes.

The habits that matter more than the password

1. Never reuse. Unique password per site is the single change that neutralises credential stuffing. It is only practical with a manager.
2. Use a password manager. Bitwarden (free, open source), 1Password, or the one built into your browser or OS. All of them generate, store and autofill; autofill also protects against phishing, because the manager will not fill a password on a lookalike domain.
3. Turn on two-factor authentication everywhere it is offered, preferring an authenticator app or hardware key over SMS.
4. Check for breaches. Enter your email at Have I Been Pwned; if a password has leaked, change it at that site and anywhere it was reused.
5. Do not rotate on a schedule. Forced 90-day changes lead to Password1, Password2. Modern guidance (NIST 800-63B) says change only when there is a reason.

Frequently asked questions

Is a 12-character password enough?

If it is genuinely random across letters, digits and symbols, yes for almost all purposes (about 78 bits). If it is a word with substitutions, no, regardless of length.

Are passphrases really as strong as random strings?

Per character, no; per password, yes, because they are longer. Four random words from a large list is comparable to 8–9 random characters, and six words beats most random strings people would tolerate typing.

Is it safe to generate a password online?

If the generator runs in your browser using a cryptographic source and does not send the result anywhere. Check that the page works with the network disconnected; the ToolzDirectory generator does.

Should I write passwords down?

A written list at home is safer than reuse; the threat is remote attackers, not your housemate. A password manager is better than both.