Password security FAQ

Entropy, in information theory, measures the expected unpredictability of a value. For passwords, it is the logarithm base 2 of the number of equally likely values an attacker would need to search through. A password with 80 bits of entropy requires 2⁸⁰ guesses on average to find — roughly 1.2 × 10²⁴.

The formula for a randomly generated password is: entropy = log2(pool_size) × length. Pool size is the number of distinct characters you can draw from; length is the number of characters. Both increase entropy, but length scales linearly while pool size scales logarithmically — so doubling the length has a larger effect than doubling the pool size when pool sizes are already in the dozens.

Complexity rules (must contain uppercase, lowercase, digit, symbol) increase the minimum pool size from 26 to 95 characters — about a 1.9x increase, adding roughly 0.9 bits per character. A single additional character adds about 6.6 bits (at full ASCII). Adding one character therefore beats adding all four character classes combined.

More importantly, complexity requirements train users to create predictable substitutions — P@ssw0rd! — which rule-based crackers target directly. These substitution patterns have well-known entropy far below what the pool size calculation suggests.

For protection against offline attacks on common hash algorithms (bcrypt at cost 10, Argon2id), 60 bits is a practical floor; 80 bits is conservative; 100+ bits is effectively unbreakable at any foreseeable compute cost. For fast hashes (MD5, SHA-1) used by negligent services, 80 bits remains a minimum. NIST SP 800-63B recommends at least 8 characters of arbitrary composition but does not specify entropy floors — treat that as a starting point, not a target.

Using a 95-character pool (full printable ASCII):

• 12 characters — 78.9 bits. Strong against most offline attacks.
• 16 characters — 105.1 bits. Very strong; sufficient for all current threat models.
• 20 characters — 131.4 bits. Adequate for a master password you store in a manager.

If you are using only alphanumeric characters (pool of 62), add 2-3 more characters to compensate for the smaller pool.

Yes, but less than length. Including symbols expands the pool from 62 to 95 characters, adding about 0.63 bits per character. That is meaningful but not decisive. A 14-character lowercase-only random password has 65.9 bits of entropy; adding symbols makes it 92.2 bits at the same length. The symbols help — but adding 5 more characters of lowercase has almost the same effect.

What matters more: that the password is truly random, not chosen by a human, because humans systematically underestimate the entropy of their "random" choices.

Credential stuffing. When a service is breached, attackers test the stolen credentials against all other major services. If you reuse a password, one breach compromises everything. Uniqueness is the single property that limits blast radius, and only a password manager makes uniqueness practical at scale.

Not at equal character count. A random character drawn from 95 printable ASCII characters provides about 6.57 bits; a word drawn from a 7,776-word EFF list provides about 12.9 bits, but represents 4-8 characters on average. Per character typed, the random password wins.

Per word, the passphrase wins — but words are much longer than single characters. The practical question is: what length of passphrase provides adequate entropy while remaining memorisable? Answer: 7-8 words from a large word list (7,000+) reaches 90-100 bits, which is very strong. The same entropy from a random character password requires about 14-16 characters.

Using the EFF Large Word List (7,776 words, ~12.9 bits per word):

• 5 words — 64.6 bits. Acceptable for low-risk accounts.
• 6 words — 77.5 bits. Strong for most uses.
• 7 words — 90.5 bits. Very strong; suitable for a master password.
• 8 words — 103.4 bits. Conservatively very strong.

This site's passphrase generator uses a 480-word list (about 8.9 bits per word), requiring 9 words to reach 80 bits.

Marginally. A single randomly chosen digit appended to a passphrase adds log2(10) = 3.32 bits. That is less than adding another word. Random capitalisation or random punctuation are similarly modest additions. The most effective improvement is a longer word list or more words.

Yes. The single most impactful security action for most people is using a password manager with a unique, randomly generated password for every account. Password reuse is responsible for the vast majority of account compromises that are not caused by phishing. A manager eliminates reuse automatically.

Risk is concentrated, not eliminated. The trade-off is: accept many small risks (one weak or reused password per site) versus one larger risk (your manager is compromised). The maths strongly favour the manager: a major password manager with a strong master password and hardware MFA is far more secure than typical human-managed passwords across dozens of services.

Mitigate the concentration risk by: using a very strong master password (9+ word passphrase), enabling a hardware security key on your manager account, and keeping a manual backup of the most critical credentials in a physically secure location.

The answer depends on the manager's architecture. In a zero-knowledge model, the provider never has your master password or the plaintext of your vault — they store an encrypted blob that only your master key can open. A breach of their servers exposes the encrypted vault, not the passwords inside. An attacker would then need to crack your master password offline; a strong passphrase with 80+ bits of entropy makes this impractical.

Managers that do not use a zero-knowledge model represent a higher risk in the event of a server breach.

A physical device — typically USB-A, USB-C, or NFC — that stores a private cryptographic key and performs authentication via a signed challenge-response. The challenge includes the relying-party origin (the domain), so the key will not authenticate to a phishing domain even if it looks identical to the real one.

FIDO2 supersedes the older U2F standard; both are supported by most current security keys. FIDO2 supports passwordless login (passkeys) in addition to the second-factor use case.

A password is a static secret. When you type it into a phishing page, the attacker receives it and can immediately replay it against the real service. A FIDO2 challenge-response is ephemeral and domain-bound: the key signs a challenge that includes the origin. A phishing domain receives a signature that is valid only for itself, not for the real service. The attacker gains nothing usable.

• FIDO2 security keys — eliminate phishing for email, cloud storage, financial accounts. One of the highest-impact investments in personal security.
• Encrypted USB drives — transport sensitive files without risking loss of plaintext data if the device is physically stolen.
• Privacy screen filters — prevent visual credential theft in public spaces (coffee shops, airports).
• Hardware wallets — keep cryptocurrency private keys air-gapped from internet-connected devices.

Using window.crypto.getRandomValues(), the Web Crypto API provided by your browser. This is a cryptographically secure pseudo-random number generator (CSPRNG) seeded by operating system entropy. It is the same source used for TLS key generation.

The implementation uses rejection sampling to avoid modulo bias — a subtle flaw that makes some values slightly more probable than others when mapping a random integer to a smaller range. Each character is drawn independently with uniform probability.

No. Generation, entropy calculation, and the passphrase composer all run entirely within your browser. The page makes no network requests during generation. Nothing is logged, transmitted, or stored. Close the tab and the password is gone.

Through Amazon affiliate links in the hardware security section. When you click a product link and make a qualifying purchase on Amazon, we receive a small commission at no additional cost to you. We are registered under the Amazon Associates Program (tag: faiza013-20). We do not sell advertising, collect personal data for advertising, or recommend products we would not use ourselves. Full details: affiliate disclosure.