Password-strength meters love a confident verdict: “This would take 3 seconds to crack” or “7 million years.” Both can be true for the same password, depending on who is attacking and how. Here is what actually determines strength — and what to ignore.
Short answer: Make it long and random, and never reuse it. Generate one with the Password Generator — it uses your browser’s cryptographic randomness, so nothing is uploaded and every result is genuinely unpredictable.
Length beats “complexity”
The math is simple. The number of possible passwords is the size of the character set raised to the length. Adding one more character multiplies the guesses an attacker needs; swapping an a for an @ barely changes anything.
| Password | Why it’s weaker than it looks |
|---|---|
P@ssw0rd! |
Short, and every substitution is one attackers try first |
Summer2026 |
A word plus a year — top of every guessing list |
w7kZ!qLp |
Random but too short (8 chars) |
correct-horse-battery-staple |
Long and random — strong and memorable |
That last one echoes the famous XKCD comic: several random words are far harder to guess than a mangled single word, because the strength comes from how many words could have been chosen, not from looking complicated. The catch is that it only works when the words are truly random — that exact famous phrase is now in every cracking list, so pick your own.
What “crackable in X” really means
Those countdown numbers assume one particular scenario: an attacker has stolen a database and is guessing offline as fast as their hardware allows. In that world:
- Fast, outdated hashing (like unsalted MD5) can mean billions of guesses per second.
- Modern slow hashing (bcrypt, scrypt, Argon2) deliberately slows each guess to a crawl.
- A live login that locks or throttles after a few tries is slower still.
So the same password might be “instant” against a badly-built site and “centuries” against a well-built one. Use the estimate to compare your passwords to each other — not as a literal promise.
The mistake that beats any password: reuse
Most accounts are not lost to clever cracking. They are lost to credential stuffing: a breach leaks your email and password from one site, and bots try that pair on hundreds of others. If you reused it, the strongest password in the world just unlocked your inbox.
The fix is boring and effective:
- A unique password per site. This is the single biggest win.
- A password manager to remember them so you don’t have to.
- Two-factor authentication wherever it’s offered, so a leaked password alone isn’t enough.
What modern guidance actually says
Security bodies have quietly reversed a lot of old advice. Current thinking (echoing NIST’s guidelines) is:
- Favor length over forced symbols. Long is what matters.
- Allow everything, including spaces and long passphrases.
- Stop mandatory monthly changes — they push people toward
Password1,Password2, and so on. - Screen against known breached passwords instead of demanding arbitrary complexity.
In short: one long, unique secret you keep beats a short, “complex” one you rotate into predictability.
Generate one the safe way
- Open the Password Generator and set the length to 16 or more.
- Keep all four character types on for maximum strength — switch off symbols only if a site rejects them.
- Copy the result straight into your password manager — the value never leaves your browser.
Prefer something you can type from memory, like a device login or your password-manager master password? Build a passphrase by hand: string together five or six unrelated, random words. It’s the one strong secret worth memorizing, and the generator’s random strings cover everything else.
Need to send a secret to someone, not just store one? The Encrypt Text tool turns a message into ciphertext you can share as a link, decrypted only by a passphrase you give them separately.