How to Write Strong Passwords (and Why Length Beats Complexity)
Published June 16, 2026
Prepared by Innealan Editorial
Password advice has changed a lot over the last decade. The old guidance, “8 characters, one uppercase, one number, one symbol,” has given way to a simpler approach: use a long, unique value and let a password manager generate it when possible.
Why length matters more than complexity
Password strength against brute-force guessing is measured in bits of entropy, roughly:
$$ \text{entropy} = \log_2(\text{charset size}^{\text{length}}) = \text{length} \times \log_2(\text{charset size}) $$
A 10-character password using only lowercase letters (26 characters) has about $10 \times \log_2(26) \approx 47$ bits of entropy. A 16-character password using only lowercase letters has about $16 \times \log_2(26) \approx 75$ bits, far stronger despite using a smaller character set. Length dominates.
That is why a multi-word passphrase can be easier to remember than P@ssw0rd1!. A manager-generated random password is usually the better choice for a site password because memorability is no longer required.
Practical guidance
- Use a password manager. You only need to remember one strong master password; everything else can be fully random and unique per site.
- Aim for 16+ characters for anything important, using a generator rather than something memorable. Memorable patterns are exactly what attackers’ wordlists target.
- Never reuse passwords across sites. A single breached, reused password lets attackers try it everywhere else (“credential stuffing”).
- Use a password manager’s built-in generator, or a tool that uses a secure random source.
Math.random()in JavaScript is not cryptographically secure and should never be used to generate passwords, tokens, or keys.
If a site refuses a generated password, do not shorten and reuse an old one. Check whether it supports paste and autofill, then use a different unique password that meets its documented rules. The site’s password policy may be weaker than current guidance.
How our generator works
Our Password Generator uses the Web Crypto API’s crypto.getRandomValues(), the same cryptographically secure random source used for generating encryption keys, instead of Math.random(). You can configure length and which character sets to include, and nothing you generate is ever sent over the network.