What the numbers mean
Password strength is measured in bits of entropy: the number of guesses an attacker needs, written as a power of two. A random password drawn from C possible characters with length L has L × log₂(C) bits. With all four character types this generator uses 90 characters (it leaves out quotes, backslashes and spaces, which some sites reject), so each character adds 6.5 bits. Every extra bit doubles the work. The times shown are for guessing half the possibilities, the average case, and they only apply to randomly generated passwords. A human-chosen password such as Summer2026! has far less real entropy than its length suggests, because attackers try common words and patterns first.
| Random password | Bits | Offline, fast hash | Offline, slow hash |
|---|---|---|---|
| 8 characters, all types | 51.9 | 6.0 hours | 6.8 thousand years |
| 12 characters, all types | 77.9 | 45 thousand years | longer than the age of the universe |
| 12 lowercase letters | 56.4 | 5.5 days | 151 thousand years |
| 16 characters, all types | 103.9 | longer than the age of the universe | longer than the age of the universe |
| 20 characters, all types | 129.8 | longer than the age of the universe | longer than the age of the universe |
| 4-word passphrase | 51.7 | 5.1 hours | 5.8 thousand years |
| 6-word passphrase | 77.5 | 35 thousand years | longer than the age of the universe |
| 6-digit PIN | 19.9 | instantly | 50 seconds |
"Fast hash" assumes a well-equipped attacker trying 100 billion guesses a second against a leaked database of fast hashes such as MD5. "Slow hash" assumes 10,000 a second against a properly stored password (bcrypt, scrypt or Argon2).
Passphrases
A passphrase strings together random words, such as Tulip-Canopy-Absurd-Gravel-Mango-Swift. Each word is picked from the EFF's 7,776-word list, which adds 12.9 bits per word, so six words give about 77.5 bits: stronger than a random 11-character password (71.4 bits) and much easier to type on a phone or remember. The words must be chosen by the generator, not by you, or the strength calculation no longer holds.
Good password habits
Current US government guidance (NIST SP 800-63B, revision 4) favours length over complexity rules, recommends at least 15 characters for a password used on its own, and says passwords should not be changed on a schedule, only when there is a sign they were exposed. In practice: use a different password for every account, keep them in a password manager, and turn on two-factor authentication or passkeys for email, banking and anything holding money. Reused passwords are the main way accounts are taken over after another site is breached.