Why Password Length Beats Complexity
For years, sites told you to add !@#$% and numbers. But NIST changed their guidelines in 2017 — length matters more than special characters. A 20-character password using only lowercase letters has more entropy than an 8-character password with every character type.
Here's why: each character added multiplies the search space. An 8-character password with 94 possible characters = 94^8 = 6.1 quadrillion combinations. A 20-character password with just 26 lowercase = 26^20 = 19 sextillion combinations. That's 3 billion times harder to crack.
The Entropy Math
Password strength is measured in bits of entropy. Each bit doubles the number of guesses needed:
- 28 bits — crackable in seconds (e.g. "password123")
- 60 bits — takes a GPU farm a few days
- 80 bits — impractical to crack (centuries)
- 128 bits — physically impossible with current technology
Our Password Generator uses crypto.getRandomValues() — the same CSPRNG that powers HTTPS. This is not Math.random(). It's cryptographically secure.
Should You Use a Password Manager?
Yes. Generate a unique 32-character password for every site, store it in a manager (Bitwarden, 1Password, KeePassXC). You only memorize one master password. Every other password is random and unique — so when a site gets breached, your other accounts are safe.
Passphrases vs Passwords
An alternative: use 4-5 random words. "correct-horse-battery-staple" has ~44 bits of entropy and is easier to remember than "Tr0ub4dour&3". But a 32-character random string from our generator has ~190 bits. Use a password manager and you don't need to remember anything.
What About 2FA?
Always enable two-factor authentication when available. Even a strong password can be stolen via phishing. 2FA stops attackers even if they have your password. Use an authenticator app (Authy, Aegis) over SMS — SIM swapping is a real attack.
Common Mistakes
- Reusing the same password across sites
- Using personal info (names, dates, pet names)
- Using patterns like "Password1!" — meets complexity rules but cracks in seconds
- Storing passwords in browser autofill on shared computers
- Not enabling 2FA "because it's inconvenient"