Password & Passphrase Generator

Learn about password strength

What actually makes a password hard to crack

It comes down to entropy, driven mainly by length and the size of the character pool a password draws from, not how clever the pattern looks. A longer random password beats a shorter one with substitutions like @ for a, since attackers already account for those substitutions in the tools they use to guess passwords.

Passwords vs. passphrases

A diceware-style passphrase, several random dictionary words strung together, can be both easier to remember and, at a decent word count, comparable or stronger in entropy than a shorter string of random characters. It's also faster and less error-prone to type. A password manager removes the memorability tradeoff entirely, if you're comfortable relying on one.

Common questions

Is a longer password always better than a shorter, more complex one? Generally, yes. Each added character multiplies the total guessing space, and that usually outweighs the effect of packing more character types into a shorter string.

Why do some sites reject a strong, randomly generated password? Some still enforce outdated rules, like a low maximum length, banned special characters, or oddly specific character-class requirements. That's a limitation of the site's own validation, not a real weakness in the password itself.

How often should a password actually be changed? Current guidance from NIST and most security researchers is to change a password after a suspected compromise, not on a fixed schedule. Forced periodic rotation without a reason tends to push people toward weaker, more predictable passwords instead.