Password entropy explained: why passphrases beat symbols, and what the crack-time number means
The advice to use "at least one uppercase letter, one number and one symbol" produced a generation of passwords likePassword1! — which satisfies every rule and is among the first things any attacker tries. The rule was always a proxy for the
thing that matters, and the thing that matters is measurable.
Entropy, in one paragraph
Entropy counts how many equally likely passwords the generator could have produced, expressed in bits. Each extra bit doubles that
number. A random password drawn from a 62-character alphabet carries about 5.95 bits per character, so 16 characters is roughly
95 bits. Below 60 bits is weak against a determined offline attack; 80 is solid; above 100 is comfortable for a long time.
Entropy is a property of how the password was generated, not of the string itself. correct-horse-battery-staple is strong when a
machine picked four random words and worthless once it is printed in an article.
Why passphrases win
Four words drawn randomly from a 2000-word list gives about 44 bits; six words gives about 66; seven gives 77 — and you can type it
on a TV remote without crying. Because the strength comes from length rather than exotic characters, passphrases survive the places
symbols break: phone keyboards, terminals, WiFi setup screens, dictation.
Pronounceable passwords are a real tradeoff
Syllable-based passwords like bralotenki42 sit between the two. They are shorter than a passphrase, memorable enough to retype
from a screen, and far stronger than anything a human invents unaided. Use them for things you must occasionally type by hand.
Reading the crack-time estimate
Crack time assumes an offline attack: the attacker has the password hashes and is guessing at roughly 100 billion attempts per
second on rented hardware. It deliberately ignores the site's own rate limits, because those protect you only until the database
leaks. Treat it as a floor, not a promise.
Bulk generation
Seeding a staging environment, issuing initial credentials, rotating a set of service accounts — you rarely need one password. Give
the generator a count and it produces a list you can copy or download as a text file.
Rules that still hold
- Never reuse a password across services; a leak anywhere becomes a leak everywhere.
- Length beats complexity every single time.
- Use a password manager and let the passwords be unmemorable.
- Turn on two-factor authentication wherever it is offered.
Every password here is generated in your browser with crypto.getRandomValues, never Math.random, and nothing is transmitted
anywhere.