How to Create a Strong Password: Length, Entropy and the Manager Solution

The advice you've heard a hundred times - mix capitals, numbers, symbols - is not wrong, but it's the second-order factor. Looking at how password managers are built and at public breach databases, the pattern is clear: most cracked passwords were short (under 14 characters) or reused, not because they lacked an exclamation mark.

Length matters because of brute-force attacks - every extra character makes guessing exponentially harder.

And once it's strong, you rarely need to rotate it - see how often to change your password.

Locked out right now? Our step-by-step on what to do when you forgot a password can help.

Here is what actually makes a password strong, explained without jargon.

Length beats complexity. Uniqueness beats length. A password manager handles both automatically.

01 - How to Create a Strong Password: The Right Method

A strong password combines 3 elements: 16+ characters, unique per site, and truly random. The most reliable method: use a password manager to generate a 20-character random string per site (tK3#mRpQ$wLnXb8v). For the one master password you memorize: a 6-word Diceware passphrase (cave-goblet-frost-parish-anvil-gloom ≈ 78 bits of entropy). Avoid: dictionary words, dates, substitutions like p@ssw0rd - these patterns are the first tested by cracking tools, regardless of how complex they appear.

02 - Why Length Is the Real Variable

Password strength is measured in bits of entropy - the number of random choices that went into creating it. Each additional bit doubles the search space an attacker has to cover.

Concrete example:

The column that matters is the last one. S@mmer2024! looks complex and has exactly the complexity rules most sites require. But it falls in minutes because cracking tools apply those same rules systematically.

The formula: every 3 extra characters of a random password add ~20 bits of entropy. Going from 12 to 16 characters is the single most impactful change you can make.

02 - Entropy Explained Simply

Think of entropy as the number of possible passwords given how yours was built:

• 6-character lowercase only (monkey): 26^6 = 308 million combinations. A GPU does that in seconds.
• 8-character mixed case + digits (MyDog7Qs): 62^8 = 218 trillion combinations. Fast hardware: a few hours.
• 16-character fully random (tK3#mRpQ$wLnXb8v): 95^16 = 4×10^31 combinations. Out of reach for any attacker.

Where most people go wrong: using a real word as a base. Attackers do not brute-force every character combination - they start with dictionaries of the 10 billion most common passwords, leaked credentials, names, and words, then apply mutation rules. P@ssw0rd! fails in under a second because it IS in those dictionaries.

Random = unpredictable. That is the only thing entropy actually measures.

03 - The Diceware / Passphrase Method

If you need a password you can actually type and remember (your master password for a password manager, or your laptop login), a passphrase is the best option.

Method:

1. Get a physical die (or use EFF's online diceware tool)
2. Roll 5 times to generate a number like 25341
3. Look up the word in the EFF Large Wordlist
4. Repeat for 5-6 words
5. Separate with hyphens or spaces

Result: something like cellar-invoke-mossy-fright-blanket-groan

• 5 words: ~65 bits of entropy
• 6 words: ~78 bits of entropy (equivalent to a 13-character fully random password)
• Completely memorable
• No pattern an attacker can exploit

Why it works: the words were chosen by true randomness (a physical die), not by your brain. Human choices are predictable - we pick words we know, things we like, dates that matter. A die does not.

04 - Common Mistakes That Undermine Strong Passwords

Understanding what makes a password weak is as important as knowing what makes one strong.

Predictable substitutions: p@ssword, 3mail, s3cur1ty - these character swaps have been in cracking rules for 15 years. They add almost nothing against modern tools.

Appended numbers and symbols: Password123!, Summer2024#. Cracking software appends numbers 1-9999 and all common symbols as a first pass. Takes seconds.

Personal information: birthdays, pets' names, sports teams, children's names. These are the basis for targeted attacks (spear-phishing) and are often already in data brokers' profiles.

Keyboard patterns: qwerty, 123456, asdfghjkl. Attacked first, every time.

Reuse across sites: this one is the silent killer. When any of the hundreds of sites you use gets breached (and breaches happen constantly - Have I Been Pwned lists 14 billion leaked credentials), attackers try those username/password pairs on every other major service automatically. One reused password = a single point of failure for your entire digital life.

05 - Evaluation Criteria: How We Ground This Guide

To ground the claims in this article, we rely on the standard entropy formula (log₂(N)^L, where N is the character pool and L the length), the published behaviour of password managers and public sources:

Password length and entropy

Entropy grows with length. The table below applies the standard log₂(N)^L calculation for a full character set:

Takeaway: set your password manager to 20 characters by default (not 16 - the memorization effort is identical since the manager remembers for you).

Character types: real impact on entropy

The same formula applied to a 16-character password across different character pools:

Conclusion: adding symbols adds ~9 bits compared to alphanumeric-only at 16 characters - equivalent to 1-2 extra characters. Length is the dominant lever; character types are a secondary amplifier.

Generation algorithm: crypto.getRandomValues vs Math.random

A critical point often overlooked: the quality of the random generator used.

• Math.random() (JavaScript): pseudo-random, not cryptographically secure. Used by some low-quality online generators. Absolutely avoid for passwords.
• crypto.getRandomValues() (Web Crypto API): CSPRNG fed by the OS (Windows CryptGenRandom, Linux /dev/urandom, macOS SecRandomCopyBytes). Current standard for serious managers.
• /dev/urandom (Linux/macOS native): same source server-side. All serious managers (Bitwarden, 1Password, NordPass) use the OS equivalent.

Our password generator exclusively uses crypto.getRandomValues() - verifiable by inspecting the page source (no network request during generation).

Local vs cloud storage: the security/convenience trade-off

Verdict: for most users, audited zero-knowledge cloud (Bitwarden, NordPass, 1Password) offers the best balance. Pure local (KeePassXC) is relevant only for high-risk profiles (journalists, dissidents) or use cases without mobile sync needs. Self-hosting is a good option for technical users who want control + convenience.

06 - Why a Password Manager Is the Real Answer

The goal of password security is to have a unique, random, long password for every single account. That is genuinely impossible to do in your head once you have 50+ accounts.

A password manager solves this entirely:

1. Generator: creates a 20-character random password on demand (tK3#mRpQ$wLnXb8v) - you never see or think about it. You can also try one right now with our free password generator
2. Encrypted vault: stores everything behind AES-256 or XChaCha20 encryption, zero-knowledge model (the provider cannot see your passwords)
3. Autofill: fills the right password on the right site - also protects against phishing (if the URL doesn't match, it won't fill)
4. Breach alerts: monitors your emails against leaked credential databases, warns you when a site you use is compromised

You only need to memorize one password: your master password. Make it a 6-word diceware passphrase. Write it on paper and store it somewhere safe. That's it.

07 - Comparing the Best Options

Three managers worth considering at different price points:

Bitwarden (free or $10/year Premium)

• Open source, code publicly audited by Cure53 and Insight Risk
• Unlimited free plan across all devices - no asterisk
• Strong choice for privacy-conscious or technical users
• Self-hostable with Vaultwarden

Proton Pass (free or $1.99/month Pass Plus)

• Open source clients, Swiss jurisdiction
• Integrated with Proton ecosystem (Mail, VPN, Drive)
• Good option if you already use Proton services

NordPass ($1.49/month on 2-year plan)

• Modern polished UX with native biometrics
• XChaCha20 + Argon2id encryption
• Cure53 2022 + SOC 2 Type 2 audits published
• Nord Security ecosystem (NordVPN, NordLocker)

All three generate strong random passwords and store them safely. The right choice depends on your existing ecosystem and how much you want to pay.

See our best password manager comparison 2026 for the full benchmark, and our detailed Bitwarden review for a deep technical look at Bitwarden's security model.

08 - Practical Action Plan

If you take nothing else from this guide:

1. Today: Check haveibeenpwned.com with your main email. If any breach appears, change those passwords immediately. Use our password strength checker to evaluate your current passwords before replacing them.
2. This week: Install Bitwarden (free). Import your saved passwords from your browser. It handles the migration automatically.
3. Going forward: Every time you create an account or update a password, let the manager generate it. Never type something you invented yourself.
4. Master password: Create a 6-word diceware passphrase. Store it on paper in a safe place. Do not store it digitally anywhere.

The password problem is a solved problem - password managers solved it. The only remaining step is to use one.

See our Proton Pass vs Bitwarden comparison if you're deciding between the two open source options.

For quick reference on technical terms used in this guide (entropy, PBKDF2, Argon2id, brute force, credential stuffing), see the PwdFortress password security glossary.

PwdFortress may receive a commission on purchases made through links in this article. This does not affect our editorial recommendations - all managers mentioned are compared on the same criteria.