How Strong Is Your Password? Length, Entropy and Passphrases
A random password's strength depends on its length and the characters it uses, measured in bits of entropy. Length matters most: 16 random characters beat any 8-character password. Human-invented passwords are far weaker than they look, which is why a generator matters.
What makes a password strong
A password is strong when it's hard to guess, and for a password chosen at random that comes down to one number: how many possible passwords an attacker would have to try. That number is measured in bits of entropy. Each extra bit doubles the work.
For a random password, entropy = length × log2(size of the character set).
| Characters used | Set size | Bits per character |
|---|---|---|
| Digits only | 10 | 3.32 |
| Lowercase letters | 26 | 4.70 |
| Lowercase + digits | 36 | 5.17 |
| Lower + uppercase | 52 | 5.70 |
| Lower + upper + digits | 62 | 5.95 |
| All four sets incl. symbols | about 94 | 6.55 |
Length beats complexity
Here is the entropy of random passwords at different lengths:
| Characters used | 8 chars | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|
| Digits only | 27 bits | 40 bits | 53 bits | 66 bits |
| Lowercase | 38 | 56 | 75 | 94 |
| Lower + upper + digits | 48 | 71 | 95 | 119 |
| All four sets | 52 | 79 | 105 | 131 |
A 16-character password of only lowercase letters (75 bits) is far stronger than an 8-character password with every character type (52 bits), and nearly as strong as a 12-character one with every type (79 bits). Adding length is the easiest way to add strength, and longer lowercase passwords are easier to type on a phone.
How long would guessing take?
Speeds vary hugely. A website that limits login attempts might allow a few guesses per minute. An attacker who has stolen a database of password hashes can test offline, and for a fast, poorly chosen hash a powerful rig can try on the order of 10 billion guesses per second. Assuming that worst case, the average time to find a random password is:
| Entropy | Example | Average time at 1010 guesses/second |
|---|---|---|
| 40 bits | 12 digits | about 1 minute |
| 53 bits | 16 digits | about 5 days |
| 60 bits | – | about 2 years |
| 71 bits | 12 chars, letters + digits | about 3,700 years |
| 78 bits | 12 chars, all sets, no ambiguous characters | about 480,000 years |
| 95 bits | 16 chars, letters + digits | about 60 billion years |
Sites that store passwords properly use slow hashes that cut these speeds by factors of thousands or more. The table is a deliberately pessimistic scenario.
The catch: entropy only applies to random passwords
The numbers above assume every character was picked at random. Passwords people invent aren't random.
Summer2026! uses all four character types across 11 characters, which looks like 72 bits on paper, but it
follows the most common human pattern: a word, a year, a symbol at the end. Attackers try those patterns and
leaked passwords first, so the real strength is tiny. Common substitutions like P@ssw0rd don't help either.
That's why a generator matters. The Password Generator picks each character with your browser's cryptographic random number generator (the Web Crypto API), so the table above actually applies.
Passphrases
A passphrase is several random words, like orbit-candle-maple-quiet-harbor. If each word is picked at
random from a list of 7,776 words (the size of the widely used Diceware list), each word adds 12.9 bits:
- 4 words: 51.7 bits
- 5 words: 64.6 bits
- 6 words: 77.5 bits, comparable to a 12-character random password with all character types
Passphrases are easier to remember and type than random characters, which makes them ideal for the few passwords you type by hand, such as a computer login or a password manager's master password. The words must be chosen at random, not a phrase you like.
Settings to choose in the generator
- Length: 16 or more for accounts in a password manager; the generator supports 6 to 64.
- Character sets: keep all four on unless a site rejects symbols. If it does, add 2–3 characters of length instead.
- Exclude ambiguous characters (such as I, l, 1, O and 0) if you'll ever read or type the password by hand. It costs almost nothing: all four sets drop from about 6.55 to 6.48 bits per character.
Beyond the password itself
- Use a different password for every account. Reuse is the biggest real-world risk: one leaked site unlocks the others.
- Use a password manager so unique 16–20 character passwords cost you no effort.
- Turn on two-factor authentication, ideally an authenticator app or passkey, for email, banking and social accounts.
- Don't change strong passwords on a schedule. Change them when there's a reason, such as a breach.
Frequently asked questions
How long should a password be?
At least 15 characters for a random password used on its own, which is the minimum in NIST’s current guidelines, and 16 or more where you use a password manager. For passphrases, at least 5–6 random words.
Are symbols necessary?
They add some strength per character, but length adds more. A 16-character password without symbols is stronger than a 10-character one with them.
Is a generated password stored anywhere?
The Utivaro generator creates passwords in your browser and doesn't send them to a server. Save the password in your password manager straight away.
What is password entropy?
A measure, in bits, of how many possible passwords an attacker would have to try. Each bit doubles the number.