How to Create a Strong Password — Length, Character Sets, Entropy

A strong password is one that is hard for others to guess and resistant to brute-force cracking. Rather than making it "complicated" by feel, understanding why it becomes strong leads to safe, sustainable habits. This guide explains the criteria simply.

The idea of entropy (bits)

Password strength can be expressed as "entropy," a logarithm of the total number of possibilities, measured in bits. Each additional bit of entropy roughly doubles the number of attempts needed to crack it. As a rule of thumb, above 70 bits is considered strong.

Entropy comes from the number of character types and the length. With N possible characters and length L, the possibilities are N to the power of L. The key insight: length increases the number of multiplications, so lengthening a password strengthens it more efficiently than adding character types.

Length vs. character variety: which wins?

• Increase length: the biggest effect — a few more characters raises entropy substantially
• Add character types: helpful, but less than length; lengthening often beats adding symbols
• Avoid guessable elements: names, birthdays, dictionary words, and keyboard patterns (qwerty) effectively lower entropy

Reuse is the biggest risk

No matter how strong, reusing a password across services is dangerous. If one service leaks, attackers can break into others that share the same password (credential-stuffing). Using a different password per service matters even more than length or character variety.

Practical habits

The most practical approach is a long, random, unique password per service, stored in a password manager — so you only need to remember the manager’s master password. Our password generator creates strong passwords with cryptographic randomness and shows entropy and a strength meter. Register the generated password directly into your manager for safety.