How strong is your password, really?

Most password rules ask for "at least one capital, one number and one symbol". Those rules produce passwords like Summer2025!, which meets every requirement and falls to a guessing attack in seconds. Real strength comes from something else: how many guesses an attacker would need.

Strength is the number of guesses

Attackers don't try every combination in order. They start with leaked password lists, dictionary words, names, dates and common patterns ("capital first, number and symbol at the end"). A password is strong when it isn't near the front of that queue.

For passwords made randomly, we can measure this with entropy, in bits. Each bit doubles the number of guesses needed:

Password	How it's made	Entropy
8 random lowercase letters	26⁸	about 38 bits
8 random printable characters	94⁸	about 52 bits
12 random printable characters	94¹²	about 79 bits
16 random printable characters	94¹⁶	about 105 bits
4 random words from a 7,776-word list	7,776⁴	about 52 bits
6 random words from the same list	7,776⁶	about 78 bits

The formula is simple: length × log₂(size of the alphabet). Adding one character from a 94-character set adds about 6.6 bits. Adding one random word from a 7,776-word list adds about 12.9 bits.

The catch: entropy only counts if it's random

The table assumes every character or word was picked at random. Summer2025! is 11 characters from the full set, so on paper it looks like 72 bits. In practice it's a season, a year and an exclamation mark, a pattern near the top of every cracking list. Human-chosen passwords are far weaker than their length suggests.

That's why the password strength checker doesn't just count characters. It looks for dictionary words, keyboard runs like qwerty, repeated characters, dates and common substitutions (p@ssw0rd), and estimates guesses from what's left. Everything happens in your browser, so the password you test isn't sent anywhere.

How long is long enough?

It depends on how the password is stored. If a site stores passwords with a slow hash like bcrypt, attackers who steal the database might manage thousands of guesses per second per machine. If it uses a fast unsalted hash, they might manage billions.

A sensible target for anything you care about is at least 70 to 80 bits of real randomness. That's 12 or more random characters, or 6 random words. For a password manager's master password, aim higher.

Random characters or a passphrase?

Both work, if they're random.

• Random characters are compact. Use them for accounts where a password manager fills the field and you never type it. The password generator uses your browser's cryptographic random number generator and shows the entropy of what it makes.
• Passphrases are easier to type and remember: ledger-cactus-mantle-orbit-sleet-pirate. Use them for the few passwords you type by hand: your device login, your password manager, your email. The passphrase generator picks words at random from a large list; the randomness is what makes it strong, not the words.

Don't build a passphrase from a song lyric or a favourite quote. Attackers have those lists too.

Strength isn't everything

A unique 20-character password is still useless if it's reused on a site that gets breached, or typed into a phishing page. The habits that matter most:

1. Use a password manager and a different password for every site.
2. Turn on two-factor authentication, ideally with an app or a hardware key rather than SMS.
3. Change a password when a service is breached, not on a fixed calendar.

Get those right and password strength becomes the last line of defence instead of the only one.