How to Create a Strong Password: Length, Entropy and Password Managers

How passwords get cracked

Attackers use three main methods: credential stuffing, which replays user names and passwords leaked from other sites; dictionary attacks, which try common passwords and words; and brute force, which tries every combination.

Most real-world damage comes from the first. However complex a password is, reusing it means that the weakest site you use can expose all your accounts. A unique password for every site matters even more than strength.

Measuring strength with entropy

The strength of a randomly generated password is measured in bits of entropy: length × log2(number of possible characters). Each extra bit doubles the number of guesses an attacker must try.

A six-digit PIN has about 20 bits—only a million possibilities, which a computer tries instantly. Twelve random characters from the 94 printable ASCII symbols give about 79 bits, and sixteen random lowercase letters give about 75 bits.

6 digits                      : 6 × log2(10)  ≈ 20 bits
16 random lowercase letters   : 16 × log2(26) ≈ 75 bits
12 random chars from 94       : 12 × log2(94) ≈ 79 bits
16 random letters and digits  : 16 × log2(62) ≈ 95 bits

These figures only hold for random choices. Human-made passwords such as Password1! or birthday combinations look varied but sit at the top of every attack list, so their real entropy is close to zero.

Why length beats complexity

As the table shows, adding length raises entropy far more efficiently than adding character types. The US National Institute of Standards and Technology's digital identity guidelines (SP 800-63B) likewise recommend allowing long passwords and checking them against breached-password lists rather than forcing composition rules.

For passwords you must remember, a passphrase of four to six unrelated random words works well. Six words chosen at random from a 7,776-word list give about 77 bits while staying memorable. The words must be chosen randomly—by dice or a generator—not by you.

Patterns to avoid

All of these are built into cracking rules and fall much faster than they appear.

• Names, birthdays, phone numbers or licence plates that can be found on social media.
• Keyboard walks such as qwerty, 1q2w3e4r or asdf.
• A word followed by digits or ! (for example summer2026!).
• Substitutions like a→@ and o→0, which cracking tools try by default.
• Rotating by changing only a number (pass01 → pass02).

The practical answer: a password manager and 2FA

Nobody can memorise a different 20-character random password for every site. A password manager is the realistic solution: you remember one strong master passphrase and let the generator create and store the rest.

Add two-factor authentication—an authenticator app, a security key or passkeys—so that a leaked password alone is not enough. Secure your email account first, because it is the reset channel for every other account.

What to check in a password generator

A good generator uses a cryptographically secure random number generator provided by the operating system. General-purpose functions such as Math.random are predictable and unsuitable for passwords.

The AIBIZAP password generator lets you choose the length and character sets. If a service does not allow special characters, increase the length instead: sixteen letters and digits already give about 95 bits. For machine secrets such as API client IDs and secrets, use the client credential generator.