Password generation: what actually makes a password strong

Password strength comes down to entropy — roughly, how many guesses an attacker would need to try before finding the right one. Length and character variety both add entropy, but they don't add it equally, and understanding the difference explains why so many "strong" passwords are actually weak.

Why "P@ssw0rd!" fails

Swapping letters for lookalike symbols and numbers feels like it should help, but attackers have known about this trick for decades. Password-cracking tools include dictionaries of common words with exactly these substitutions already built in. "P@ssw0rd!" is cracked about as fast as "password" — the substitution barely moves the needle because the underlying word is still guessable.

Why length wins

Each additional character in a truly random password multiplies the number of possible combinations, rather than adding to it. A random 12-character password drawn from a large character set has vastly more possible combinations than a random 8-character one — enough that the difference in crack time isn't measured in multiples, but in orders of magnitude. This is why security guidance has shifted from 'use symbols' to 'use length': a long random password beats a short clever one almost every time.

Random vs memorable

There are two reasonable approaches. Fully random strings (generated by a password manager or generator tool) maximize entropy per character, but you can't memorize them — which is fine, since you shouldn't be memorizing passwords for accounts a manager can store. Passphrases (several random, unrelated words strung together) trade some entropy per character for actual memorability, and can still be very strong if the words are genuinely randomly chosen rather than a phrase you made up, since made-up phrases are far more guessable than people expect.

The practical checklist

• Use a unique password for every account — reused passwords mean one breach compromises everything.
• Favor length over complexity rules — 16 random characters beats 8 characters crammed with symbols.
• Use a password manager so you never have to remember or reuse anything.
• Turn on two-factor authentication wherever it's offered — it protects you even if a password does leak.

Processa's password generator produces cryptographically random passwords with adjustable length and character sets, generated locally in your browser — nothing is sent anywhere, which matters for a tool whose entire job is generating secrets.