2026-07-04 · Calc-Tools Editor

Password Generator Guide: How to Create Strong Passwords

Your password is one of the few security controls that you alone configure and you alone pay for. The awkward part is the timing: the decision takes seconds, while the consequences arrive years later, and usually not as "someone guessed it" but as "my email address and a password turned up in a dump from some other site."

This guide skips the button-by-button walkthrough. It covers three things you can actually reason about and trade off: what determines strength, what attackers are really doing, and how little effort it takes to push your risk down. Every search-space figure below was computed from the formula itself, so you can recheck the arithmetic.

1. Password strength is a calculation

Write strength as a formula and it has only two variables: entropy = length × log2(charset size), where charset size is the number of characters a password could be drawn from — 10 digits, 26 lowercase letters, 62 letters and digits, or 94 printable ASCII characters excluding the space.

The structure of that formula matters more than its numbers: length is a multiplier, while the character set only changes how much each character contributes. Going from a 10-character set to 94 raises the per-character contribution from 3.32 bits to 6.55 bits, less than double, whereas every extra position multiplies the whole search space by the size of the set. "Add a symbol" and "add a character" are never operations of the same magnitude, and the worked examples below put a number on the gap.

A third variable is easy to overlook: whether those bits are actually random. If a password comes from a predictable source — a non-cryptographic pseudo-random function, or a seed taken from the clock — then even a hundred bits of nominal length can collapse into a search space an attacker finishes in minutes. Random-source quality is an engineering problem of its own, covered in the random number generator guide and the random number generator; the conclusion to carry over is that length and character set set the ceiling, and the random source decides whether that ceiling is real.

2. Dumps, stuffing and spraying: why one breach cascades

What leaks in a breach decides your exposure. If passwords were stored in plaintext, the leak is immediate and total. If hashes were stored, the algorithm decides the rest: a salted, deliberately slow hash (bcrypt, scrypt, Argon2) raises the cost of every guess by orders of magnitude, while an unsalted fast hash from the MD5 and SHA-1 era is close to plaintext once dedicated hardware is pointed at it.

What turns a single breach into a disaster, however, is reuse. An attacker holding an email-and-password pair from site A does not need to crack anything: they simply replay the pair on sites B and C. That is credential stuffing, and because it is nearly free while its success rate depends only on user habits, it has remained one of the most cost-effective attacks around. Its companion is password spraying, which tries a handful of common passwords across a large number of accounts precisely to stay under per-account lockout thresholds.

So the real cost of reuse is not one lost account, it is a chain: once the mailbox is taken over, the attacker can use "forgot password" to reset almost everything else, and nothing looks anomalous, because those reset messages genuinely arrive in your inbox.

The same chain has an entrance that needs no password at all: the session. If the session identifier a browser holds after login is guessable — a sequential ID, or a weak random value — the attacker can present it directly and bypass the password entirely. Such identifiers must be unpredictable random values, which is the class of requirement the UUID generator covers.

3. Six attacks and what actually stops them

Treating "change the password" as the only available action usually means imagining a single kind of attack. Real attacks target different links in the chain, and the defences that work against each are different too:

Two conclusions in that table run against intuition. First, a strong password does not stop phishing: against a real-time proxy, both your password and your one-time code are forwarded to the genuine site as you type them, so length buys nothing; only a domain-bound hardware key or passkey refuses to answer. Second, changing your password does not stop session hijacking: if the attacker already holds a valid session token, no number of password changes affects it. The correct response there is to sign every device out from the account's security settings.

4. Four worked examples

Every figure below is computed from "search space = charset size ^ length", with one assumed attack rate used only for comparing magnitudes: one billion guesses per second (an assumption, not a measurement, and the average hit lands halfway through the space).

Example 1 — the marginal value of a bigger charset. Widening the set from 10 characters to 94 takes an 8-character password from 1.0000 × 10⁸ to 6.0957 × 10¹⁵, a factor of 61 million. At the assumed rate, though, the average time only moves from 0.05 seconds to about 35.3 days: a large relative jump that still sits at the edge of what a one-off attack can afford, because attackers can run in parallel and hold the hardware for weeks.

Example 2 — the leverage of length. Keep the set at 94 and go from 12 characters to 16: the space rises from 4.7592 × 10²³ to 3.7157 × 10³¹, a factor of 78.08 million, and the average time moves from about 7.54 million years to about 5.887 × 10¹⁴ years. Four extra keystrokes push the result beyond anything an actual attack can reach. That is the arithmetic behind "length first".

Example 3 — passphrases. Phrase strength comes from the word-list size. Drawing at random from a 7,776-word list, four words give 3.6562 × 10¹⁵ (about 21.2 days) and six words give 2.2107 × 10²³ (about 3.5 million years): each additional word multiplies the space by 7,776, so two more words is a factor of 60.47 million.

Example 4 — putting both shapes on one ruler. Four random words (51.7 bits) are roughly equivalent to an 8-character full-charset password (52.4 bits); six words (77.5 bits) match 12 characters (78.7 bits); eight words (103.4 bits) match 16 characters (104.9 bits). The point is not that phrases are stronger, but that a phrase buys the same strength at a much lower memory cost — which is the subject of the next section. To produce the random-string figures in the table, use the password generator.

5. Passphrases: long and memorable at the same time

There is one requirement for building a passphrase: draw the words at random from a fixed list rather than inventing them yourself. Words a person invents cluster around a small set of common nouns, nearby objects and personal history, so the real entropy is far below that of a random draw. "I love the blue ocean" reads long and is highly guessable.

The standard method is to take a list of fixed size — commonly several thousand words — draw four to six entries with a cryptographically secure random source, and join them with a separator. The separator is only there for readability: replacing a hyphen with a symbol adds a fraction of a bit per word, far less than adding one more word.

Which shape to use depends on whether a human brain has to remember it:

• Must be remembered (password-manager master password, device login, primary mailbox): a passphrase of about six words, roughly equal to a 12-character random string, with a much lower typing-error rate.
• Never remembered (websites and apps): 16 characters or more from a generator, stored by the manager. There is no reason to trade strength for memorability here.
• Used once and discarded (one-off signups, trials): still use the generator. These low-value accounts are exactly the ones most likely to sit in a breached database, and they are often tied to your everyday email address.

6. Password managers and 2FA: what each one actually stops

A password manager solves the cost of uniqueness, not the problem of insufficient length. It delivers three concrete gains: a different 16-character random string for every site; one master password to remember; and autofill that only fires on a matching domain, so a look-alike site usually gets nothing. Its risk is concentrated in one place — the master password and the recovery flow become a single point of failure. So the master password needs passphrase-grade strength, the manager account itself needs two-factor authentication, recovery codes belong offline, and exporting a plaintext vault into a chat app or a cloud note is best avoided.

Two-factor authentication is likewise not one thing but a ladder of options with very different strength. From weakest to strongest: SMS codes (open to SIM swap and interception); codes from an authenticator app (computed locally, independent of the carrier, still forwardable by a real-time phishing proxy); push approvals (convenient, but exposed to fatigue attacks that spam prompts until one is accepted); and hardware keys or passkeys (bound to the domain, so a look-alike site cannot obtain a usable response at all). Choose by account importance — whatever can reset your other accounts should sit at the top of that ladder.

Tiering your accounts is more realistic than applying one strength level everywhere, and far easier to actually finish:

The ordering follows the attacker's path, not how important an account sounds. Anyone who gets into tier 1 can reach most of the rest through "forgot password". With limited time, hardening tier 1 pays far more than upgrading twenty forum logins one by one.

7. Why "change it every 90 days" fell out of favour

Early institutional guidance required changing important passwords every 90 days, on the logic that this shortens the window in which a leaked password is usable. The problem is the side effect: forced rotation pushes people into predictable increments — a season, a year and an exclamation mark, with one character changed next time — and those patterns are exactly what rule-based cracking dictionaries cover. Frequent rotation also nudges people toward shorter, easier-to-recall secrets. The security gained tends to be smaller than the strength lost.

The digital identity guidance SP 800-63B dropped mandatory periodic expiry for memorised secrets in its 2017 revision and moved to changing them when there is evidence of compromise. For an individual, that evidence looks like: the provider tells you about a breach; you see a login or a device you do not recognise; you typed the password on an untrusted device or network; or a breach-checking service reports your address in a new data set.

Use breach checks the right way round: check the address, not the password. Entering your email tells you which data sets it appears in and therefore what kind of risk you face. If the finding is only "this site's account data was in a dump", the question is whether plaintext passwords were exposed. If the password itself is confirmed exposed, changing that one account is nowhere near enough — every site where you reused it has to change as well.

8. Frequently Asked Questions

How much does adding a few special characters really help?

Less than most people assume. Moving from a 62-character set (letters and digits) to 94 (adding symbols) raises each character's contribution from 5.95 to 6.55 bits; at 8 characters the space grows from 2.1834 × 10¹⁴ to 6.0957 × 10¹⁵, roughly 28 times. Length behaves differently: every extra position multiplies the space by the full charset size, so going from 12 to 16 characters is a factor of 78.08 million. Symbols are valuable mainly because they break the dictionary-word shape, not because they carry the security.

Should I still change my passwords on a schedule?

Change on events, not on a calendar. Without evidence of compromise, frequent rotation pushes people toward "season + year + exclamation mark" patterns that rule-based dictionaries already contain. The triggers worth acting on are: the provider reports a breach, you spot an unfamiliar login, you entered the password on an untrusted device, or a breach check shows your address in a new data set. Replace it with a fresh random string rather than editing the old one.

Doesn't putting every password in one manager concentrate the risk?

It does concentrate risk on a single master password, while eliminating reuse, which is far more likely to hurt you in practice. Three offsets: make the master password an actual six-word passphrase rather than an ordinary password; enable two-factor authentication on the manager account itself; and keep recovery codes offline so you cannot lock yourself out. Whether the provider can read your vault depends on its design — with zero-knowledge encryption, data is encrypted and decrypted locally and the server only stores ciphertext.

What should I do first when a service tells me my password leaked?

Establish the scope before you start changing things. If only that one site's data set leaked, change that account first and review the email address and payment details attached to it. If the same password was used elsewhere, change every site that reused it in one pass — changing a single account is the same as changing none. Then review login history and authorised devices, sign out sessions you do not recognise, and confirm that two-factor authentication is on.

Are SMS codes a reliable second factor?

Better than nothing, and the weakest rung of the ladder. Their security depends on the carrier: a SIM swap moves your messages to an attacker's handset, and SMS can be intercepted on some networks. Against a real-time phishing proxy, the code you type is forwarded instantly along with your password. For important accounts, prefer an authenticator app; for the accounts that can reset everything else, go straight to a hardware key or passkey.

9. Three common misconceptions

Misconception 1: substituting characters makes a strong password. Swapping letters for look-alike symbols and tagging an exclamation mark onto the end still leaves you with a variant of a dictionary word. Rule-based cracking dictionaries are built from exactly those habits, so the substitution adds a handful of extra guesses. The test is simple: if a person can see at a glance which word your password came from, it sits inside the dictionary's coverage.

Misconception 2: rotating more often is safer. In personal use, scheduled rotation often backfires. To keep the password memorable, people build predictable sequences — the same root with a different suffix, or a month number — and once one version leaks, the next is easy to derive. What actually protects you is randomness and uniqueness, not freshness.

Misconception 3: two-factor authentication makes an account untouchable. It protects the login step, not a session that already exists. If a device is under malware control or a session token is stolen, the attacker operates the account with a valid session and no code is ever requested. The right response is not another password change but a visit to the security settings: review devices, sign them all out, and reset sessions if needed.

10. Four things you can finish today

• 1. Tier your accounts before touching anything. Two levels are enough: can this account reset the others, or not? The primary mailbox, the phone account and the password manager are tier 1. Convert those three to unique passphrases with two-factor authentication first; that beats tidying up small accounts one by one.
• 2. Use a phrase where memory is required, a generator everywhere else. Keep a six-word random passphrase for the handful of secrets a human must recall, and generate 16+ character strings with the password generator for everything else, stored in a manager. The one rule that cannot bend: no password is ever reused.
• 3. Treat recovery codes as part of the account. When you enable two-factor authentication, store the recovery codes offline in two places — a printed copy and one on an offline device. They are both the guard against locking yourself out and the only way back in when a device is lost.
• 4. Make breach checking routine. Run a breach check on your primary address now and then, act immediately on provider security notices, and glance at the list of logged-in devices while you are there. Each takes a couple of minutes and covers most of the "it already happened and nobody told me" cases.