- What makes a strong password?
- Length, randomness and uniqueness. Use at least 12–16 characters drawn from a mix of uppercase, lowercase, digits and symbols, generated by a cryptographic random source. Never reuse passwords across accounts.
- How long should my password be?
- Aim for 16+ characters with all character classes enabled, which gives ~100 bits of entropy — well beyond the reach of any modern GPU cracking rig. Length matters more than complexity: a 20-char lowercase password is stronger than an 8-char complex one.
- How is password entropy calculated?
- Entropy (bits) = length × log2(charset_size). A 12-character password using all 94 printable ASCII characters has 12 × 6.55 ≈ 79 bits of entropy. Each additional bit doubles the cracking difficulty.
- Are random passwords safer than passphrases?
- Both can be very secure. Random passwords are shorter for the same entropy; passphrases (4–6 random words) are easier to type and remember. For a password manager, use random passwords — you copy-paste them anyway.
- Should I use a different password for every site?
- Yes, always. If one site is breached, attackers try the leaked password against your other accounts (credential stuffing). A password manager plus this generator makes unique-per-site passwords effortless.