The quick answer
You need a new password and want one that is strong without being clever. Make a random one with the password generator and put it straight into a password manager.
- Pick Password (a string of characters) or Passphrase (random words, easier to type and read out).
- Set the length. The generator starts at 20 characters, or 6 words for a passphrase.
- Press Copy and save it in your password manager before you close the page, because the page does not remember it.
- Use a different one for every account. If a site rejects some symbols, edit the symbol list, or turn symbols off and add a few characters.
The generator's own guidance: 16 random characters is plenty for ordinary accounts, 20 or more suits email, banking and your password manager, and 8 or more words suits a secret you must type from memory.
Entropy in plain words
Entropy counts how many different results a generator could have produced, written in bits. One bit is two possibilities, and every extra bit doubles the number, so 10 bits is 1,024. For a password of n characters picked at random from a pool of p characters, the entropy is n × log2(p) bits. A lowercase letter adds 4.70 bits, a digit 3.32 and a character from all 94 printable ASCII characters 6.55.
| Length | Digits (10) | Lowercase (26) | Letters and digits (62) | All 94 characters |
|---|---|---|---|---|
| 8 | 26.6 bits | 37.6 bits | 47.6 bits | 52.4 bits |
| 12 | 39.9 bits | 56.4 bits | 71.5 bits | 78.7 bits |
| 16 | 53.2 bits | 75.2 bits | 95.3 bits | 104.9 bits |
| 20 | 66.4 bits | 94.0 bits | 119.1 bits | 131.1 bits |
Twelve random lowercase letters (56.4 bits) beat eight characters from the full set (52.4 bits). Sixteen lowercase letters (75.2 bits) come within 3.5 bits of twelve characters from everything (78.7 bits). Going from lowercase to all 94 characters adds 1.85 bits per character, while one more lowercase letter adds 4.70, so one extra letter is worth about two and a half characters of added variety.
ClipLime's default symbol list has 23 symbols, so its full pool is 26 + 26 + 10 + 23 = 85 characters, and the default 20 characters come to about 128 bits. These figures are exact for a secret from a random generator and say nothing about one you invented.
What the bits mean, as an illustration
Here is one illustration, not a prediction. It assumes an attacker who has stolen a list of fast hashes, knows how the secret was made and tries 100 billion guesses a second, the assumption the generator page uses. The time is the average, half of the search space. A site that limits login attempts, or stores passwords with a slow hash, is far harder to attack.
| Random secret | Bits | Average time in this illustration |
|---|---|---|
| 8 characters, all 94 | 52.4 | about 8 hours |
| 12 lowercase letters | 56.4 | about 5.5 days |
| 6 words | 60.0 | about 67 days |
| 16 lowercase letters | 75.2 | about 7,000 years |
| 12 characters, all 94 | 78.7 | about 75,000 years |
| 8 words | 80.0 | about 190,000 years |
The ordering is the point: length moves a secret up the table faster than a wider character set does.
Passphrases: words instead of symbols
A passphrase is several random words joined together. The generator draws each word from a list of 1,024, and 1,024 is 2 to the power of 10, so every word adds exactly 10 bits.
| Words | Bits | Same strength as this many random characters from all 94 |
|---|---|---|
| 4 | 40 | 6.1 |
| 5 | 50 | 7.6 |
| 6 | 60 | 9.2 |
| 8 | 80 | 12.2 |
| 10 | 100 | 15.3 |
Bit for bit, a passphrase is as strong as a random password. The difference is the cost: 10 bits take one word of about five letters, but only about one and a half characters in a full symbol password. Choose words when you must type the secret on a phone or read it aloud.
The strength comes entirely from the words being picked at random. A phrase you invent, such as a lyric or a sentence about your pet, is far weaker than its length suggests, and swapping letters for look-alike symbols adds almost nothing because attackers try those swaps first. Capitalizing each word adds no strength, and a random number from 0 to 99 on the end adds about 6.6 bits. Six words suits an account behind a slow hash. For a password manager's master password, use 8 or more.
Why reuse is the real danger
Once you use it twice, a 128 bit password is only as safe as the least careful site that holds it. When one site is breached, attackers try the leaked address and password on other services, so length cannot rescue a reused password. The first rule is one password per account. The second is two-factor sign-in wherever it is offered, so that a stolen password is not enough on its own. A strong password does not help if it is typed into a fake page, and a fake page can sometimes relay a one-time code, which passkeys and security keys resist.
A password manager makes one password per account practical by remembering them for you, at the cost of trusting one product and one master secret, so choose with care, protect it with a long passphrase and two-factor sign-in, and keep a recovery plan.
What a generator in the browser does, and does not do
- It makes every character with
crypto.getRandomValues, the random source your browser uses for encryption keys, and neverMath.random, which is not designed to be unpredictable. - It picks fairly. Using the remainder of a random number would make some characters slightly likelier, so values that would cause that are redrawn. Asking for at least one character of each kind makes it start over until a password qualifies, which costs about a tenth of a bit at 20 characters.
- It stores and sends nothing, not even your settings. Copy the password before you leave.
- It cannot know where you will type the password, how that site stores it, or whether the page asking for it is a fake.
To check, open the Network tab in your developer tools and press Generate new: no request is made. For more assurance, load the page, switch off your connection and generate, which the page says works the same offline.
Secrets, identifiers and tokens
A UUID is an identifier, not a secret. A version 4 UUID carries 122 random bits (128 minus 6 fixed ones), but the standard does not promise it is unguessable and a version 7 shows when it was made, so make IDs with the UUID generator and secrets with the password generator. A password stored as Base64 in a config file is still a plain password, as Base64 encoding and decoding explained shows with the Base64 decoder.
The signing secret for an HS256 token should be at least 256 bits. At 6.55 bits per character that is 40 random characters, and decoding a JWT token explains why. Sites should store a slow, salted hash of your password. Fast hashes such as the ones in the hash generator let an attacker try billions of guesses a second against a leaked list, and verifying a download with a hash covers what they are good for instead.
If a site you use was breached
- Change the password on that site now, to a new random one.
- Change it everywhere else you used it, starting with your email and anything that handles money. Email can reset your other accounts.
- Turn on two-factor sign-in for the accounts that offer it.
- Check the recovery address, phone number and any mail forwarding on your email account. Someone with access may have changed them.
- Be careful with messages that mention the breach. Type the site's address yourself instead of following a link.