Strong passwords in practice: length, passphrases and breach checks

Most account takeovers do not involve clever hacking. Attackers take passwords leaked from one website and try them on others, or they run automated guesses against common patterns such as Name@1234. A strong password is one that resists both: it is long enough and random enough that guessing it is impractical, and it is unique to a single account so a leak elsewhere does not unlock it.

Why length beats complexity

Password strength is usually measured in bits of entropy, a way of counting how many guesses an attacker would need in the worst case. Each extra bit doubles the work.

For a randomly generated password, entropy is roughly length × log₂(size of the character set):

Password type	Character set	Entropy per character	12 characters	16 characters
Lowercase only	26	4.7 bits	56 bits	75 bits
Lower + upper + digits	62	5.95 bits	71 bits	95 bits
All printable ASCII	94	6.55 bits	79 bits	105 bits

Adding four characters gains more than switching from letters to the full symbol set. That is why modern guidance, including NIST Special Publication 800-63B, recommends long passwords and discourages forced composition rules such as “one capital, one number, one symbol”.

There is an important catch: these numbers only apply to random passwords. Summer2026! uses upper case, lower case, digits and a symbol, but it follows a pattern attackers try early: a common word, a year and an exclamation mark. Its real strength is a tiny fraction of what the formula suggests. The Password Strength Checker looks for such patterns, including dictionary words, keyboard walks like qwerty, repeated characters and dates, and estimates crack times realistically.

How long is long enough?

For accounts protected by online rate limiting (the site locks or slows down after failed attempts), 12 random characters are already very strong. The bigger danger is an offline attack, where an attacker has stolen a database of password hashes and can try billions of guesses per second on their own hardware. For important accounts such as email, banking and password managers, aim for:

• 16 or more random characters, or
• a passphrase of 5–6 random words.

The Password Generator uses your browser’s cryptographically secure random number generator and shows the entropy of what it creates. It can exclude look-alike characters such as l, 1, O and 0 if you need to type the password by hand.

Passphrases: strong and memorable

A passphrase is several randomly chosen words, for example velvet-orbit-canyon-mosaic-thrive. If the words are picked at random from a list of 7,776 words (the standard Diceware size), each word adds about 12.9 bits. Five words give roughly 64 bits and six give about 77 bits, comparable to a 12-character fully random password but far easier to remember and type on a phone.

The key word is random. A phrase you invent, such as a song lyric or quote, is much weaker because attackers use lyrics, quotes and common phrases in their guesses. Let a tool such as the Passphrase Generator choose the words.

Check whether a password has been breached

Billions of real passwords have leaked in data breaches. If a password appears in those lists, attackers will try it early, however complex it looks. The Have I Been Pwned service maintains a database of these passwords and offers a privacy-preserving way to check them called k-anonymity:

1. Your browser computes the SHA-1 hash of the password.
2. Only the first five characters of that hash are sent to the service.
3. The service returns every leaked hash that starts with those five characters, often several hundred.
4. Your browser compares the rest of the hash locally.

The service never sees your password or even its full hash. The Pwned Password Checker works exactly this way. If a password shows up, stop using it everywhere, even if it is “only” used on unimportant sites.

Use a password manager

Nobody can remember dozens of unique 16-character passwords. A reputable password manager generates, stores and fills them for you, so you only need to remember one strong passphrase. Most managers also warn you about reused and breached passwords. Built-in managers in major browsers and operating systems are a reasonable starting point; dedicated managers add features such as secure sharing and cross-platform support.

Add a second factor

Even a perfect password can be phished. Two-factor authentication (2FA) means a stolen password alone is not enough. In order of strength:

1. Passkeys or hardware security keys (FIDO2/WebAuthn): resistant to phishing because they are tied to the real website.
2. Authenticator app codes (TOTP): six-digit codes that change every 30 seconds, generated from a shared secret. The TOTP Generator shows how these codes are calculated under RFC 6238 and is handy for testing.
3. SMS codes: better than nothing, but vulnerable to SIM-swap fraud.

Enable 2FA first on your email account. Whoever controls your email can reset almost every other password you have.

A simple plan

1. Install a password manager and protect it with a long passphrase.
2. Turn on 2FA for email, banking and the password manager itself.
3. Check your most important passwords against breach data.
4. Replace reused and breached passwords with generated ones, starting with the most valuable accounts.
5. Never reuse a password across sites.

Strong security is less about memorising complicated strings and more about using randomness, length and uniqueness, then letting tools do the remembering for you.