Most password advice from a decade ago — mix uppercase, lowercase, a digit, a symbol — optimizes for the wrong thing. It produces passwords that are hard for humans to remember but not especially hard for a computer to guess, because people respond to that rule in predictable ways: capitalize the first letter, swap "a" for "@", add "!" at the end. Attackers know these patterns and build them into their guessing tools.
What actually makes a password hard to crack: entropy
Entropy measures how many possible passwords an attacker would have to try before finding yours, expressed in bits. It's a function of two things: how many characters are in your alphabet (lowercase-only vs. lowercase+uppercase+digits+symbols) and how long the password is. Doubling the alphabet size adds one bit per character; adding one more character multiplies the total search space by the alphabet size — which is why length dominates.
A random 8-character password using upper, lower, digits, and symbols (a 94-character alphabet) has about 52 bits of entropy. A random 16-character password using only lowercase letters (26-character alphabet) has about 75 bits — stronger, despite the "simpler" alphabet, purely because it's longer.
Why "correcthorsebatterystaple" works
This is the classic example from the XKCD comic that popularized the idea: four random common words, concatenated, produce a passphrase that's both long (high entropy) and genuinely memorable, unlike a random string of symbols. The catch is the word selection has to actually be random — a phrase you made up by thinking of "words that go together" has far less entropy than truly random word selection, because human-generated phrases follow predictable patterns.
For anything you don't need to memorize — which, with a password manager, is almost everything — a fully random string beats a passphrase on entropy-per-character. Passphrases exist specifically for the few passwords you do have to remember by heart, like a device unlock code or your password manager's master password.
The real fix: stop remembering passwords at all
The entropy debate matters most for the handful of passwords you have to type from memory. For everything else, a password manager generates and stores a long random password per site, so you never need to think about length or memorability at all — you just need one strong master password (ideally a passphrase) to unlock the manager itself.
This also solves the more common real-world failure mode: password reuse. A strong-but-reused password is only as safe as the least secure site you used it on — if any one of them leaks its password database, every account sharing that password is compromised too.
Try it
GlaeKit's Password Generator uses your browser's cryptographic random number generator, with adjustable length and character sets — nothing is sent to a server.
Frequently asked questions
How long should a password be?
At least 12–16 characters for most accounts if it's randomly generated; longer for anything especially sensitive. Many services now enforce a 64-character maximum, which is far more than needed — 16–20 random characters is already well beyond what's practical to brute-force.
Do I still need symbols and numbers if my password is long?
They help, but marginally, once length is already high. A 20-character random lowercase password is already extremely strong; adding digits and symbols pushes it further but the length is doing most of the work.
How often should I change my passwords?
Current guidance (including from NIST) is to stop forcing periodic changes — they tend to make people pick weaker, more predictable passwords to make the rotation less annoying. Change a password when there's a specific reason: a breach notification, suspicious activity, or reuse across sites you're now consolidating.