What "strength" actually measures

Entropy estimates the uncertainty in a random generation process. The familiar length × log₂(character-pool size) formula applies only when every character is chosen independently and uniformly from that pool. Human-created passwords rarely meet that assumption, so calculated bits can greatly overstate their resistance to guessing.

Why substitutions don't help as much as they feel like they should

Attackers prioritize leaked passwords, words, patterns and substitutions before exhaustive brute force. Replacing “a” with “@” or “o” with “0” remains predictable. Random generation and avoiding reuse matter far more.

Bar chart of password entropy in bits: 8 lowercase-only characters (38 bits), 8 characters from a full character set (52 bits), 16 characters (105 bits), and 20 characters (131 bits) 38 bits 8 chars, lowercase only 52 bits 8 chars, full character set 105 bits 16 chars, full character set 131 bits 20 chars, full character set
The chart shows theoretical entropy for uniformly random characters, not a measured cracking time or a score for human-made passwords.

What length alone buys you

For passwords generated from the same uniform character pool, doubling the length doubles the entropy in bits and squares the number of possible strings. That mathematical benefit does not turn a long quotation or repeated pattern into a random password.

Why a password manager changes the calculation entirely

A password manager can generate and store a unique random credential for each account. Protect the vault with a strong master password and multifactor authentication where available, and keep recovery information current.

Practical choices

Symbols expand the pool when chosen randomly, but they do not rescue a short predictable pattern. Follow the site’s rules and favor additional random length.

A passphrase can be strong when its words are selected randomly from a sufficiently large list. A quotation, lyric or familiar phrase remains vulnerable even when it is long.

There is no universal safe length for every threat and policy. Use long manager-generated passwords, respect each service’s limit and never reuse them. Current security guidance should take priority over a fixed number.

Generate a strong password

Orisod’s Password Generator uses the browser’s cryptographically secure random source to create a password from your selected length and character sets. Save it securely and do not reuse it.

Generate a password →

The goal is not visual complexity. It is an unpredictable, unique credential stored safely, with multifactor authentication providing another layer when the service supports it.