How to Generate Secure Passwords: Length, Entropy, and Best Practices

Knowing how to generate a secure password is more important than ever: data breaches expose billions of credentials every year, and reused or weak passwords are consistently the leading cause of account takeovers. The conventional advice (8 characters, uppercase, lowercase, number, symbol) produces passwords like 'P@ssw0rd!' that feel complex but crack quickly with modern tools. This guide covers what actually makes a password strong, what the NIST guidelines say, how to choose a password manager, and why a strong password combined with multi-factor authentication is the complete answer.

Password entropy: the real measure of strength

Password strength is measured in entropy bits: a logarithmic measure of how many guesses an attacker would need on average to find the correct password. The more bits of entropy, the more guesses required, and the stronger the password.

A password drawn randomly from a 26-character lowercase alphabet has about 4.7 bits of entropy per character. Adding uppercase and numbers (62 characters total) gives 5.95 bits per character. Adding symbols brings it to roughly 6.5 bits per character. An 8-character password from this full set has about 52 bits of entropy. A modern GPU can compute hundreds of billions of hashes per second, making 52 bits crackable in hours against a leaked database hash.

These estimates assume offline brute-force against a hashed password database. Online attacks (guessing against a login form) are much slower due to rate limiting, but weak passwords remain at risk from credential stuffing attacks using breached password lists.

Why length matters more than complexity

A 20-character lowercase random password has 94 bits of entropy. A 12-character mixed-case-plus-symbols password has roughly 78 bits. The longer password is stronger despite using a smaller character set. Each additional character multiplies the search space multiplicatively, while adding a new character type (such as symbols) only adds a smaller fixed multiplier to that space.

The practical implication: require length first. A 16-character password from any character set is more secure than a 10-character password that satisfies every complexity rule. Password policies that force complexity but limit length to 16 or fewer characters are counterproductive.

Passphrases: strong and memorable

A passphrase is a sequence of 4 to 6 random, unrelated words. The classic example is 'correct-horse-battery-staple': four random words drawn from a ~7,000-word dictionary. Each word contributes about 12.8 bits of entropy (log2 of 7,000), giving four words roughly 51 bits and six words roughly 77 bits.

Passphrases are significantly easier to remember and type than random character strings, making them ideal for master passwords that need to be memorised rather than stored in a manager. For maximum strength, the words must be genuinely random: choosing words that form a meaningful sentence or story reduces entropy because the words are no longer independent.

NIST guidelines: what the official standard actually says

NIST (the US National Institute of Standards and Technology) publishes the most widely referenced password security guidelines in SP 800-63B. The current recommendations differ significantly from the legacy advice most people grew up with.

• •Length is the primary driver of strength. NIST recommends allowing passwords of at least 64 characters and preferably more. Minimum length for user-chosen passwords should be 8 characters, but longer is always better.
• •No mandatory periodic changes. Forcing users to change passwords regularly (every 90 days, for example) leads to predictable patterns and weaker passwords. NIST recommends only requiring changes when there is evidence of compromise.
• •No complexity requirements that constrain the search space. Requiring one uppercase, one number, one symbol is less important than length. Character-type requirements should not prevent users from choosing strong long passwords.
• •Check passwords against known compromised lists. Passwords that appear in data breach databases should be rejected, regardless of how complex they look. 'P@ssw0rd!' fails this test.
• •Allow all printable ASCII and Unicode characters, including spaces. Blocking spaces prevents passphrases.
• •No password hints or knowledge-based authentication (security questions). These reduce effective security significantly.
• •Multi-factor authentication is strongly recommended as a complement to passwords, not a replacement for a strong password.

What to avoid when generating passwords

• •Personal information: names, birth dates, pet names, phone numbers, and addresses are tried early in targeted attacks and appear in credential stuffing lists.
• •Dictionary words and predictable substitutions: replacing letters with numbers or symbols (@ for a, 3 for e, ! at the end) is in every attacker's ruleset. These patterns provide almost no additional security.
• •Keyboard patterns: qwerty, asdfgh, 1qaz2wsx, and similar walks are among the first patterns tested.
• •Reuse across accounts: one breached site exposes all accounts that share the password. This is the most common cause of account takeovers by a large margin.
• •Short passwords: under 12 characters is crackable in a reasonable timeframe against offline attacks on common hash algorithms.
• •Incremental changes: changing Password1 to Password2 when forced to update provides essentially no additional security.

How to generate a secure password: step by step

1. 1.Decide on minimum length. For general accounts, 16 characters. For financial and email accounts (which can be used to reset everything else), 20 or more characters.
2. 2.Open AlteredIdea's Password Generator. Select your character set: include uppercase, lowercase, numbers, and symbols for maximum entropy. For a passphrase, select the word-based option.
3. 3.Generate several options and choose one you can at least roughly recognise, not necessarily memorise. You will store it in a password manager.
4. 4.Copy the generated password directly into your password manager. Do not type it somewhere else first, and do not save it in a text file.
5. 5.Paste it into the new account form. Most password managers offer browser extensions that detect password fields and fill them automatically.
6. 6.Enable multi-factor authentication on the account immediately after creating it. The password is one factor; the second factor is what stops an attacker who somehow obtains it.

The case for a password manager

The only practical way to have strong, unique passwords for every account is a password manager. It generates, stores, and fills passwords for you, and you only need to remember one strong master password. A breach at one site exposes only that site's password: every other account remains secure.

The four most widely used options cover different needs and preferences. All current pricing is approximate and subject to change: verify on each provider's website.

Bitwarden is the most recommended option for users who want transparency: its code is open source and independently audited, the free tier has no meaningful restrictions, and it works across all platforms and browsers. For users already in the Apple or Google ecosystem, the built-in options are convenient and secure for everyday use.

Generating passwords safely: what to look for in a generator

Not all password generators are equivalent. The critical question is the source of randomness. Password generators that run in the browser should use the Web Cryptography API (window.crypto.getRandomValues), which provides cryptographically secure random values: the same quality of randomness used in TLS key generation and certificate signing.

Avoid generators that use JavaScript's Math.random() function. Math.random() is a pseudorandom number generator designed for simulations and games, not security. Its output is predictable given enough samples. A password generated with Math.random() is weaker than it appears.

Also avoid server-side generators: if the server generates the password, the server knows the password before you do. For a tool you trust completely, this may be acceptable. For an unknown website, it is not. AlteredIdea's Password Generator generates everything locally in your browser using the Web Cryptography API: the generated password never leaves your device.

Multi-factor authentication: completing the picture

A strong, unique password is one security factor: something you know. Multi-factor authentication (MFA) adds a second independent factor, which means an attacker who obtains your password still cannot log in without also obtaining the second factor. Even a strong password can be stolen through phishing, credential database breaches, or keyloggers. MFA is the most effective single measure available to protect an account beyond the password itself.

The three main forms of MFA available on consumer accounts today range from convenient to highly secure:

• •SMS one-time codes: the most widely available form. A code is sent to your registered phone number. Convenient but vulnerable to SIM-swapping attacks, where an attacker convinces a mobile carrier to transfer your number to their device. Use SMS MFA if it is the only option available, but prefer stronger methods where possible.
• •TOTP authenticator apps: apps like Google Authenticator, Authy, or any TOTP-compatible app generate a new six-digit code every 30 seconds based on a shared secret. Not vulnerable to SIM-swapping. The code is generated locally on your device with no network connection required. This is the recommended option for most consumer accounts.
• •Hardware security keys (FIDO2/WebAuthn): a physical device such as a YubiKey that plugs into USB or taps via NFC. Completely phishing-resistant: the key cryptographically verifies the domain of the site requesting authentication. If a phishing site tricks you into entering credentials, your hardware key will refuse to authenticate because the domain does not match. The highest security available for consumer accounts.
• •Passkeys: an emerging standard that replaces the password entirely with a cryptographic key pair stored on your device. Biometric verification (Face ID, fingerprint) unlocks the key. Passkeys are phishing-resistant by design and eliminate the password entirely for supporting sites. Adoption is growing rapidly as of 2026.

The practical recommendation: enable TOTP-based MFA on all important accounts (email, banking, work tools, password manager). Enable hardware key authentication on your most critical accounts if the service supports it. SMS MFA is better than nothing for low-value accounts where stronger options are unavailable.

Frequently asked questions

1. 1.How long should a secure password be? 16 characters is sufficient for most accounts. For email accounts and financial accounts (which control password resets for other services), use 20 or more characters. Your master password for a password manager should be a strong passphrase of at least six random words.
2. 2.Is a passphrase as secure as a random password? At equivalent entropy, yes. A six-word passphrase at roughly 77 bits of entropy is comparable to a 12-character fully random password. Passphrases have the advantage of being memorable, which matters specifically for master passwords.
3. 3.Should I change my passwords regularly? Only if there is reason to believe they have been compromised. The NIST guideline explicitly says forced periodic changes lead to weaker passwords, not stronger ones. Use a service like Have I Been Pwned to check if your email has appeared in a known breach, and change affected passwords immediately.
4. 4.Can I use the same password for work and personal accounts? No. A breach of any one system exposes both. Keep work and personal passwords completely separate, each unique.
5. 5.What is the safest way to store passwords? In a reputable password manager with a strong master password and MFA enabled. Do not store passwords in browser notes, unencrypted text files, or spreadsheets.