What Makes a Password Strong?

The two factors that actually determine strength

Ask most people what makes a password strong and they say: use uppercase and lowercase letters, numbers and a symbol. This advice is not wrong, but it misses the core principle. Password strength comes from two things and two things only: how long the password is, and how unpredictable it is. Complexity rules help only insofar as they increase unpredictability. A genuinely random password is far stronger than a memorable phrase with clever substitutions — because attackers know all the clever substitutions.

Why patterns like P@ssw0rd fail

Attackers do not guess character by character. They run dictionary attacks that test millions of known passwords and common variations. The list of known passwords includes "password", "Password1", "P@ssw0rd", "p4ssw0rd", and tens of thousands of similar predictable variations — all tested within the first seconds of any attack.

Hybrid attacks go further still: they combine words with numbers and symbols systematically. "Summer2026!" is a hybrid pattern — it follows the formula word + year + punctuation, and cracking tools generate and test every variation of this pattern automatically. "Sommer2026!" in German is on the same list. "Été2026!" in French is also there. Every language, every year, every common punctuation mark — it is all covered.

What entropy means in practice

Entropy is the mathematical measure of unpredictability. It is measured in bits: each bit of entropy doubles the number of possible values. A completely random 16-character password using all printable ASCII characters (95 options per character) has about 105 bits of entropy. A brute force attack against this has 2¹⁰⁵ possible values to check — a number with 32 digits. No hardware in existence can approach this.

The same 16 characters chosen as a memorable phrase with substitutions might have only a small fraction of that in effective entropy once dictionary and pattern attacks are applied. The difference is not cosmetic. It is the difference between "cracked in seconds" and "never cracked in practice".

Character sets and their contribution

Adding a character type expands the search space. A password using only lowercase letters has 26 options per character. Adding uppercase brings it to 52. Adding digits brings it to 62. Adding the full set of standard symbols brings it to around 95. Each expansion multiplies the search space — but length multiplies it far faster.

The practical implication: a random 12-character lowercase password is harder to crack than an 8-character password using all character types. Length wins. This is why NIST's updated guidelines no longer mandate special characters — the research simply does not support the idea that forced complexity meaningfully improves security for users who reuse passwords or choose predictable patterns.

The role of uniqueness

A strong password that is used on multiple sites is not fully strong. If any one of those sites is breached and your password is recovered — whether through poor storage, a phishing attack, or insider access — every account that shares that password is immediately compromised. Uniqueness is not optional; it is part of what makes a password strong in the real threat environment most people face, which is credential stuffing rather than targeted brute force.

What a genuinely strong password looks like

A genuinely strong password in 2026 has four properties. It is long — at least 16 characters, preferably 20. It is random — generated by a computer using a cryptographically secure random number generator, not chosen by a human. It is unique — never used on any other account, current or previous. And it is stored securely — in a password manager, not in a document, on a sticky note, or in memory.

This generator creates passwords with all four properties. It uses crypto.getRandomValues() — the browser's built-in cryptographically secure random number generator — to ensure unpredictable randomness. The output has no pattern, no words, no substitutions, and no relationship to anything a human would choose. Combined with a 16+ character length, the result is a password that defeats guessing, dictionary and brute-force attacks.

The few passwords you must remember

Not every secret can live in a password manager. The master password for the manager itself, your device login, and any disk-encryption password have to be typed from memory. For these, a passphrase of several randomly chosen, unrelated words is a good choice: it is long, easier to recall than a string of symbols, and strong as long as the words really are random. A quotation, song lyric or phrase you invented yourself is far more predictable than it feels, so let a generator pick the words, and never reuse that passphrase anywhere else.