Password Security: What Actually Makes a Password Strong

Bank websites still force you to prove your password contains an uppercase letter, a number, and a symbol — then reject the long, passphrase-like strings that would actually protect you. The research says the opposite of what those rules assume. Strength is not a checklist of character types; it is a number: how many guesses an attacker has to run before landing on your password. That number, measured in bits, is the only thing that matters. Everything else — the exclamation point you tacked on, the capital letter you moved — is mostly theatre.

Entropy: the number behind every password

Every password you could possibly create, under the exact rules you are using, can be written out as a list. The size of that list is your search space. If the password was picked uniformly from the list, an attacker working through it one by one needs, on average, half of it. The space's size, expressed as a power of two, is the password's entropy: how many bits of uncertainty the attacker has to resolve.

The mathematics is plain multiplication. With a 26-letter lowercase alphabet, an 8-character password gives 26^8 = 2.09 × 10^11 possibilities — about 38 bits. Pull in uppercase letters, digits and symbols — a full printable set of 95 characters — and the same 8 characters give 95^8 = 6.6 × 10^15 possibilities, about 52.5 bits. Every extra character multiplies the list by the size of your alphabet.

Two consequences follow. Length compounds: each added character adds log2(alphabet) bits. And the smaller the alphabet, the less each character earns: growing from 26 to 95 characters wins you about 1.9 bits per character, while adding one more random character wins 4.7 to 6.6. That imbalance is the entire argument for long passwords.

// Upper bound for a password a real random generator produced.
// Real human choices score lower — patterns occupy a smaller space.
function bits(length, charsetSize) {
  return length * Math.log2(charsetSize);
}
console.log(bits(8, 26));   // ≈ 37.6 → ~2.1 × 10^11 possible
console.log(bits(8, 95));   // ≈ 52.5 → ~6.6 × 10^15 possible
console.log(bits(12, 95));  // ≈ 78.8
console.log(bits(16, 95));  // ≈ 105.1

The formula assumes genuine randomness, and that assumption is doing all the work. It is the upper bound for real-world choices, because humans are not uniform: Sunshine1 is 8 characters, but it is nowhere near 6.6 × 10^15 possibilities. The attacker's real search space is the space of common patterns, which is thousands of times smaller.

Why the classic rules make passwords weaker

The famous checklist — at least 8 characters, a capital, a number, a symbol — was designed decades ago, before graphics cards turned password cracking into a hobbyist's pastime. It fails twice: it pushes people into predictable templates, and it punishes the one thing that actually helps, which is length.

Tell a person they need a capital, a digit and a symbol, and they will, with overwhelming probability, take an ordinary word and run it through the same three moves: capitalise the first letter, put a digit on the end, attach one symbol. The result is Password1! or its equivalent in the local language. The whole class follows one template, so the attacker never has to search the 95-character space — they search the much smaller template space. The famous xkcd example Tr0ub4dor&3 lands around 28 bits for precisely this reason.

Forced rotation makes it worse. When policy demands a new password every 90 days, people mutate the previous one: Password1! becomes Password2! becomes Password3!. If the old password ever leaks, the next one is trivially predictable. Current guidance — NIST SP 800‑63B — drops forced expiration, drops the genre fiction of complexity, and asks for length, blocklists of banned passwords, and a second factor.

Length beats complexity: the passphrase math

Four random words drawn from a 7,776-entry list — the EFF's recommended diceware list — give 7776^4 = 3.7 × 10^15 combinations, about 51.7 bits. That is comparable to a random 8-character full-set password, but written in words a human can actually remember. Even a more conservative list of 2,048 words delivers 11 bits per word — 44 bits for four words.

Set Pr3tty! next to correct-horse-battery-staple. Both look defensible. The first is 7 characters from a 95-character set — around 46 bits on paper — but it is an ordinary adjective and a symbol drawn from the tiny space of template-compliant passwords, so the real value is a fraction of that. The passphrase is 28 characters made from four independent random picks among thousands of words; because there is no pattern, the attacker gets no shortcut.

The catch — and it is a real one — is the word random. A passphrase you invent, like mycatispurple, is not four random words; it is one natural-language sentence, and a clever attacker models those too. Strength comes from the dice, not from your wit. Use diceware or a generator that picks uniformly, and stay away from any phrase that is already blinking on a blog post or in a song lyric.

• Memorable: four familiar words are easier to hold than fifteen scattered characters.
• Long: raw length blocks offline brute force before any stitching matters.
• Pattern-free: uniform random picks leave the attacker no template to exploit.
• Scales up: five random words land around 64.6 bits and stay memorable.

The real danger is password reuse

None of that entropy math protects you if the same password guards ten accounts. Breaches are not rare events; they are routine, and they happen to careful companies with competent security teams. When a hashed database leaks, the hashes are cracked offline — dictionary first, then mutations — and whatever password you used falls out in plaintext.

The attackers then run that list against every other site you use. This is credential stuffing: automated scripts try each leaked username and password pair against thousands of targets, and it works because reuse is the norm. The most valuable thing you can do is not a cleverer password — it is one unique per site.

Uniqueness at that scale is exactly what password managers automate. Which is also the flip side: the master password of your manager is the one irreplaceable secret you have, and reusing it somewhere else negates the entire model.

The attack vectors you are actually up against

• Dictionary attack: works through a ranked list of likely passwords — breached passwords, words, names, keyboard runs. It deals with sunshine1 in milliseconds.
• Brute force: tries every combination of a character set up to a length limit. Simple and slow, which is exactly why the table above matters: at a billion guesses a second, an 8-character full-set password is done in under a day.
• Credential stuffing: automates leaked username/password pairs across thousands of sites. Its success is a direct measure of password reuse.
• Phishing: impersonates a real login page and harvests the password — or the two-factor code — from the human. It bypasses every strength rule, which is why a second factor and manager autofill matter.

Notice what is absent: nobody is hacking you personally. These attacks are automated and opportunistic; they go where the math is weakest and the reuse is densest.

How password managers generate and store credentials

A password manager keeps every credential in a vault encrypted with a key derived from your master password — stretched through a slow function like PBKDF2 or Argon2 so that guessing the master password offline is hard by design. The vault is the only home of your secrets; the master password is the key that unlocks it.

Generation is where a good manager pays its rent. It creates a fresh, cryptographically random password per site — typically 15 to 20 characters across the full character set — because it never has to memorise them. The ecosystem is broader than you might think: browsers ship built-in managers, Bitwarden and 1Password sync encrypted vaults through the cloud, KeePass-style apps keep an encrypted local file. The principle is the same everywhere: one strong master key, random unique passwords for everything else.

On the far side of the login form, a responsible site does not store your password. It stores a salted hash through a slow, memory-hard function — bcrypt or argon2id. Salted means a random per-user value is mixed in, so the same password on a million sites yields a million different hashes; slow means the attacker's guesses per second collapse from billions to a few thousand. That is why a decent password survives a leaked database — and why a short one still does not, the same conclusion as the table above.

What a strong generator does differently

The difference between a toy generator and a secure one is where the randomness comes from. Math.random() is a pseudo-random generator seeded from time; it is fast, never intended for secrets, and once enough of its output is observed its internal state can be recovered, which makes the random password predictable. Browsers instead expose crypto.getRandomValues(), fed by the operating system's cryptographic randomness — the one source suited to this job.

Source is only half the story. Sampling must be uniform: taking a random number modulo the character-set length is a classic way to bias the output, so serious generators use rejection sampling. And the character set should be as wide as you can tolerate, because every class you include is bits bought back for free — while so-called ambiguous characters like 1/l and 0/O are usually dropped for readability, not for strength.

A strong generator also does nothing else: no telemetry, no copy stored in a server log, no remember-this-for-me. A password should exist in exactly one place — your clipboard for a few seconds, then your vault.

Generate strong passwords in Convrs

Convrs's password generator runs entirely in your browser: pick the length, toggle the character classes you want, and generate a whole batch in a single click. The randomness comes from the browser's cryptographic API, the entire calculation stays on your device, and nothing is transmitted, logged or stored — the only copy of your password is the one you copy out yourself.