How to Generate a Strong Password (And Why Length Beats Complexity)

A strong password is mostly about length, not complexity — a longer password using fewer character types is generally harder to brute-force than a short one packed with symbols, because each added character multiplies the possible combinations far more than each added character set does. Here's how to think about length, randomness, and reuse.

The variable that matters most: length

Password strength against brute-force guessing comes down to entropy — how many possible combinations an attacker has to try, measured in bits. Adding one more character to a password multiplies the possible combinations by roughly the size of your character set. Adding one more *character set* (like symbols) only multiplies it by a much smaller factor. A 20-character password using only lowercase letters is harder to brute-force than an 8-character password using every character type available. As a concrete target: aim for at least 60-80 bits of entropy for a normal account, and 128 bits for anything like a password manager's master password — a randomly generated 16-character password using upper, lower, numbers, and symbols comfortably clears the first bar, and 20+ random characters clears the second.

A practical way to think about it

• 12 characters, mixed types — the bare minimum for anything you care about today
• 16 characters, mixed types — a solid default for most accounts
• 20+ characters — for anything highly sensitive: your password manager's master password, financial accounts, crypto wallets

Why randomly generated beats human-created

Humans are bad at being random on purpose. Patterns like capitalizing the first letter, ending with a number, or substituting @ for a swap out predictable structure that attackers' cracking tools already account for. A password generated by a proper random source has none of that structure to exploit.

The randomness source actually matters

Not all "random" is equal. JavaScript's Math.random() is not cryptographically secure and is unsuitable for anything security-related — it's predictable enough in some environments that its output has been reverse-engineered in real attacks. A proper password generator uses crypto.getRandomValues(), the same class of randomness used for actual encryption keys.

The other half of the equation: never reuse a password across accounts, no matter how strong it is. A single breach anywhere reusing that password exposes every account tied to it — which is what password managers exist to solve.