Passwords worth trusting

Password strength is measured in bits of entropy, and the calculation is simpler than it sounds. For a password generated by picking characters at random, entropy is the length multiplied by the base-2 logarithm of the number of possible characters.

The generator above shows this figure as you adjust the settings. A 16-character password drawn from the full 94-character printable ASCII set gives roughly 105 bits.

Adding one character to a password multiplies the search space by the size of the pool. Adding a whole new character class only increases the base of that exponent once.

Compare a 12-character lowercase password at about 56 bits with an 8-character password using every printable ASCII character at about 52 bits. The longer, simpler password is stronger, and it is considerably easier to type.

This is why substitution rules produce such disappointing results. Replacing a with @ and o with 0 in a dictionary word adds almost nothing, because cracking tools have applied those exact substitutions as standard mangling rules for decades. The word is still the weakness.

How much entropy you need depends entirely on how an attacker gets to guess.

Against a live login form, the server rate-limits attempts, so even a modest password survives. Against a stolen password database, the attacker guesses offline on their own hardware, and the rate depends on how the passwords were stored.

The familiar rules, forced 90-day rotation and mandatory character classes, are no longer recommended. NIST revised its digital identity guidelines to drop both, and other standards bodies have followed.

The reasoning is behavioural. Forced rotation pushes people toward predictable increments, so Summer2024! becomes Autumn2024!, and an attacker who has seen one password can guess the next. Composition rules push everyone toward the same small set of transformations: a capital at the front, a digit and an exclamation mark at the end.

Current advice is to require reasonable length, screen new passwords against lists of known-breached values, and only force a change when there is evidence of compromise.

A passphrase built from randomly chosen words is an alternative worth knowing. Each word drawn from a 7,776-word list contributes about 12.9 bits, so six words gives roughly 77 bits and seven gives about 90.

That is comparable to a strong random password, and the result is far easier to type on a phone or read aloud. The word choice must be genuinely random, though. A memorable phrase you invented yourself carries a small fraction of the entropy the arithmetic suggests.

Passphrases suit the handful of passwords you must actually memorise: your device login and your password manager. Everything else should be long, random, and stored.

Passwords here are produced in your browser using the Web Crypto API, specifically crypto.getRandomValues, which draws from the operating system cryptographic random source. Nothing is transmitted, logged, or stored, because there is no request to send. You can confirm that by opening your browser network tools and watching for traffic while you generate.

This matters more than it might appear. A generator built on Math.random would look identical but produce predictable output, since that function is not designed for security and its internal state can often be recovered from a short run of outputs.