Security · 2026-05-01
Password security is one of those topics where everyone knows the basics but very few people actually follow the advice. We all know "password123" is terrible, yet variations of it still appear in every major data breach. This guide explains the practical reality of password security — what actually matters, what does not and how to protect yourself without making your digital life miserable.
Understanding the threat helps you make better decisions about your passwords. There are three main ways attackers break passwords:
An attacker tries every possible combination of characters. A 6-character password using only lowercase letters has about 309 million possible combinations. That sounds like a lot, but modern hardware can test billions of combinations per second. A 6-character lowercase password can be cracked in under a second.
Instead of trying every combination, attackers try common words, phrases and known passwords from previous data breaches. If your password is a real word, a name, a date or any common pattern (like "qwerty" or "letmein"), it will be found almost instantly.
When a website gets breached, the stolen usernames and passwords are tested against other services. If you use the same password on multiple sites, one breach compromises all your accounts.
Password strength is measured in entropy — the number of bits of randomness in the password. Higher entropy means more possible combinations and longer cracking times.
A 16-character password is exponentially stronger than an 8-character one, even if both use the same character types. Every additional character multiplies the number of possible combinations by the size of the character set.
- 8 characters (lowercase only): cracked in seconds
- 12 characters (mixed case + numbers): cracked in years
- 16 characters (mixed case + numbers + symbols): cracked in millions of years
Using uppercase letters, lowercase letters, numbers and symbols increases the character set size, which increases entropy per character. But length still beats complexity — "correcthorsebatterystaple" (25 lowercase characters) is stronger than "Tr0ub4d@r" (9 mixed characters).
Human-generated passwords follow predictable patterns. We capitalise the first letter, put numbers at the end and replace letters with obvious substitutions (@ for a, 3 for e, 0 for o). Attackers know all of these patterns and account for them. Truly random passwords — generated by a computer — are always stronger than anything you make up yourself.
This is the single most impactful thing you can do for your password security. A password manager generates unique, random passwords for every site and remembers them all. You only need to remember one strong master password.
Your master password should be long (at least 16 characters), genuinely random or a passphrase of unrelated words, and completely unique — never used anywhere else. This is the one password worth memorising.
Even a perfect password can be compromised through phishing or a server breach. Two-factor authentication adds a second layer — usually a code from your phone — that an attacker cannot bypass with just your password.
Services like Have I Been Pwned let you check whether your email address appears in known data breaches. If it does, change the password on that service immediately and any other service where you used the same password.
A Password Generator with a built-in strength checker analyses your password and reports:
- Length — is it long enough?
- Character variety — does it use mixed case, numbers and symbols?
- Entropy — how many bits of randomness does it contain?
- Estimated crack time — how long would a brute-force attack take?
- Known patterns — does it match common password patterns?
Use a strength checker that runs entirely in your browser. Your password should never be transmitted to a server for checking — that would defeat the purpose of keeping it secret.
Reality: Frequent forced changes lead to weaker passwords because people use predictable patterns (Password1, Password2, Password3). Use strong, unique passwords and only change them if there is a reason to (like a known breach).
Myth: Special characters are the most important factor.Reality: Length beats complexity every time. A 20-character passphrase without special characters is stronger than an 8-character password with every symbol on the keyboard.
Myth: Passwords should be impossible to remember.Reality: They should be impossible to *guess*, but that does not mean impossible to remember. A passphrase like "purple-elephant-climbs-volcanoes" is both memorable and extremely strong.
Our free Password Generator creates cryptographically secure passwords with customisable length, character types and entropy scoring, and our Hash Generator is useful if you are experimenting with how passwords get stored server-side. All generation happens locally in your browser — the passwords are never transmitted or stored.