Generate a strong random password with your chosen character types and length.
Password strength is measured in entropy — the number of guesses an attacker would need on average. Entropy depends on two things: how large the pool of possible characters is, and how many characters you use. Length contributes far more than complexity, because entropy grows exponentially with length but only logarithmically with the size of the character set. A long passphrase of ordinary words typically beats a short string of symbols, and is considerably easier to remember.
This is why current guidance from bodies including NIST has moved away from forced complexity rules and mandatory periodic changes. Those rules pushed people towards predictable patterns — a capital at the start, a digit and an exclamation mark at the end — which attackers model easily. What matters more is that each password is unique to one account, because the most common way accounts are compromised is credential stuffing, where a password exposed in one breach is tried everywhere else. A password manager and two-factor authentication do more for real security than any complexity rule, and a generated random password is only useful if you are not retyping it from memory.
A 16-character password drawn from 94 possible characters (upper case, lower case, digits and symbols) has 94¹⁶ possible combinations, about 3.7 × 10³¹. An 8-character password using only lower-case letters has 26⁸, about 209 billion. Modern password-cracking hardware can test billions of guesses per second against a leaked database, so the short password could fall in minutes, while the long one is far beyond any realistic attack.
Length does most of the work. Adding four characters usually helps more than adding a symbol to a short password.
Last reviewed: 5 November 2026 by the YogiCalc team · How we calculate and verify · Spotted an error? Tell us
Length. Entropy grows exponentially with length but only logarithmically with character-set size, so a long passphrase generally beats a short complex string, and is far easier to remember.
Current guidance says no, unless there is reason to believe one is compromised. Forced periodic changes lead to predictable minor variations, which are weaker than a single strong password kept until there is cause to change it.
Because of credential stuffing: attackers take passwords exposed in one breach and try them across other services. A unique password per account confines any single breach to that one account.
They are considerably safer than the realistic alternative of reusing or writing down passwords. They allow a unique strong password per account behind one strong master password, ideally with two-factor authentication enabled.
At least 12 characters, and 16 or more for important accounts like email and banking. Longer is stronger.
No. The password is generated locally in your browser and is not sent to or stored on our servers.