Strong Passwords & Passphrases: A Practical Guide
When to use random characters vs passphrases, how entropy works, and tips for managing credentials safely.
Entropy in a nutshell
Entropy is a measure of unpredictability. For random characters, it’s roughly length × log2(alphabet size). For passphrases, it’s words × log2(wordlist size). Aim for ≥ 64 bits for strong accounts and ≥ 80–100 bits for high-value credentials.
Passphrases vs random strings
Passphrases are easier to type and remember. Four to six words from a decent list (e.g., 2048–7776 words) often provides excellent entropy, especially with separators and optional numbers/symbols.
Symbols & ambiguous characters
Symbols slightly increase entropy, but usability matters. Excluding look-alike characters (O/0, I/l/1, etc.) reduces typos with minimal security impact at sufficient length.
Password management
Use a reputable password manager, enable multi-factor authentication, and avoid reusing passwords. Rotate credentials if you suspect compromise.
FAQ
Are the passwords stored or sent?
No — generation is client-side by default. Backend export is only used when you click it.
Is the randomness secure?
Yes — this tool uses the browser’s cryptographic RNG. Server-side generation uses a secure RNG as well.
What entropy is recommended?
64 bits is a good baseline; 80–100+ is recommended for admin, financial, or root accounts.