People judge passwords by how clever they look. A password with a capital letter, a number, and a symbol feels strong, while a long plain one feels weak. Entropy turns that instinct upside down. Entropy measures the size of the search space a password comes from — roughly, how many guesses an attacker would need to try them all — and length grows that space far faster than clever substitutions do. Once you see the arithmetic, the advice to use longer passwords stops sounding vague and starts sounding like the only advice that matters. Password Generator shows an entropy estimate in bits for each password it generates, labelled as an estimate, so you can watch the number move as you change the length.

Start small, with a four-digit PIN. There are ten possible digits in each position, and four positions, giving ten thousand combinations. That sounds like a lot until you realise a computer can try ten thousand guesses in a blink. Add one more digit and the space grows tenfold, to one hundred thousand. Each position multiplies the total by the size of the character set, which is why growth is exponential rather than gradual. A six-digit PIN has a million combinations, which is still small for a machine, but the pattern is clear: every extra character multiplies the attacker's work.

From PINs to passwords

Now widen the character set. Lowercase letters alone give 26 possibilities per position. A four-letter lowercase password has under half a million combinations — better than a PIN, but not by much. Add uppercase letters, digits, and symbols, and the set grows to roughly ninety characters. A four-character password from that set has around sixty-five million combinations, which sounds impressive and is still trivial for modern hardware. The set matters, but not as much as people think, because the set only multiplies once per character while length multiplies repeatedly.

Length is where the numbers become serious. An eight-character password from a ninety-character set has a search space in the quadrillions, which is a genuine obstacle for an attacker guessing blindly. A twelve-character password from the same set is larger by a factor of about sixty-five million again, and a sixteen-character password is larger still by a similar leap. Each added character multiplies the previous total by ninety. That is why security guidance keeps returning to length: going from eight to sixteen characters does not double the strength, it multiplies it by an almost unimaginable factor.

This is also why clever substitutions disappoint. Replacing letters with lookalike symbols — a familiar trick — does not change the length, and attackers know the common substitutions and try them early. A password's strength comes from how it was chosen, not how it looks. A randomly generated password draws each character independently from the full set, which is what makes the arithmetic above apply. A human-invented password, however complicated it looks, usually draws from a far smaller set of patterns: words, dates, and familiar substitutions that attackers have already catalogued.

Worked example: building up, step by step

Consider a fictional account holder, Sara, setting up an account on an invented service at example.com. She starts with a short password pattern of the kind many people use: a familiar word plus a number. Its entropy is low, not because the pattern looks simple, but because the word comes from a small set of common words and the number from a small set of familiar years and dates. An attacker does not try every character combination; they try common words first, and that shortcut collapses the search space.

Sara then tries a longer pattern: three unrelated words chosen at random, joined by a separator. Each word comes from a large vocabulary, so the combinations multiply across words rather than characters, and the total is far larger than the short pattern's, even though the result looks plainer. Finally she generates a random sixteen-character password using the generator, with uppercase, lowercase, digits, and symbols enabled. The entropy estimate shown is far higher than either human pattern, because every character was chosen independently at random. She stores it in a password manager rather than memorising it, which is the practical answer to the objection that long random passwords are hard to remember. They are — and that is what managers are for.

The example also shows why the generator's estimate is labelled as one. Entropy depends on how the password was made, not just on what it contains. A sixteen-character password that is actually a famous quotation has far less entropy than its length suggests, because an attacker can try quotations. The generator's number assumes random selection, which is true for passwords it generates and not necessarily true for passwords people invent. Read the estimate as "if this was generated randomly, this is its strength", not as a verdict on any string of the same length.

What entropy does not tell you

Entropy measures resistance to guessing. It says nothing about the other ways accounts are compromised, and those are more common. A high-entropy password reused across ten sites falls with the weakest of them: if one site leaks it, every site using it is exposed. A high-entropy password typed into a fake login page is handed straight to an attacker. A high-entropy password stored in plain text by a careless service is no protection at all. Length and randomness solve the guessing problem, and guessing is only one problem among several.

That is why the full advice has three parts, not one. Generate a long, random password for each account, never reuse one across accounts, and store them in a manager so you do not have to remember them. Add a second factor where it is offered, since a second factor protects an account even when the password itself is compromised. For the broader picture of account protection, including the headers that protect the sites you log into, see the HTTP security headers guide.

Honest limitations

An entropy estimate is an estimate, and it assumes random generation. It cannot detect that a password is a quotation, a name, or a pattern, and it cannot know whether the password has already leaked elsewhere. A generator also cannot protect a password after it is generated: if you paste it into an untrustworthy site, email it to yourself, or save it in an unprotected note, the entropy is irrelevant. Generate your own passwords with a trustworthy generator, store them properly, and never reuse a password shown as an example anywhere — example patterns are illustrations of structure, not passwords to adopt.

FAQs

How long should a password be in 2026?

Longer is better, and sixteen characters from a full character set is a sensible target for important accounts. Length multiplies the guessing space with every character, so the jump from eight to sixteen characters is far larger than most people expect.

What is password entropy and what does "bits" mean?

Entropy measures the size of the search space a password comes from, expressed in bits. Each additional bit doubles the space: a password with 80 bits of entropy needs roughly twice as many guesses as one with 79 bits. The figure is an estimate that assumes random generation.

Does adding symbols make a password much stronger?

It helps by widening the character set, but length matters more. Widening the set from 26 to about 90 characters multiplies the space per character, while each extra character multiplies the whole total again. A long password from a smaller set often beats a short one from a larger set.

Is a password with high entropy automatically safe?

No. Entropy measures guessing resistance only. Reuse, phishing, and leaks compromise accounts regardless of entropy, which is why unique passwords per account and a second factor matter as much as length.

The same browser-based approach protects other secrets: the Security Header and DNS Checker reviews the sites you visit, and Protect PDF adds password protection to documents without uploading them.

human review pending client designation