Password Generator

The US National Institute of Standards and Technology rewrote its password guidance in SP 800-63B and tightened it again in revision 4, published in 2024. Its core advice runs against old corporate rules: services should accept passwords of at least 64 characters, should not force a mix of uppercase, digits and symbols, should not make people change passwords on a schedule, and should instead check new passwords against lists of breached and common ones.

The reasoning is arithmetic. Composition rules push people into predictable patterns like "Summer2024!", which attackers try first. Each extra random character, on the other hand, multiplies the work of a brute-force attack by the size of the character pool. Going from 12 to 16 random characters from the 94 printable ASCII symbols adds about 26 bits, which makes guessing roughly 78 million times harder.

Entropy measures how many equally likely passwords the generator could have produced. For a random password it is length × log2(pool size). With all four character sets the pool is 94 symbols, worth about 6.55 bits per character, so 16 characters give about 105 bits. Excluding look-alike characters shrinks the pool to 84 and costs a little under a fifth of a bit per character. The table above uses the same math and assumes an offline attacker making 10 billion guesses per second, a fair figure for a GPU rig against a fast hash; a slow hash like bcrypt cuts that rate by orders of magnitude.

Passphrases work the same way with words instead of characters. The built-in list here has 367 short, common words, so each word adds about 8.5 bits and six words give about 51 bits: easy to type and remember, but weaker than a 16-character random password. Choosing "random digit" as the separator adds about 3.3 bits per gap. For a passphrase that protects something important, use eight words, or a 7,776-word Diceware list where each word is worth 12.9 bits.

The meter labels below 40 bits weak, 40 to 59 fair, 60 to 79 strong and 80 or more very strong. It rates the generator settings, not the string, which is the only honest way to score a password: "correct horse battery staple" scores high on pattern-based checkers but is the first phrase any attacker tries.

Use a different password for every account and let a password manager remember them; reuse is what turns one leaked site into many hijacked accounts. Save the password in the manager before you submit the sign-up form, and turn on two-factor authentication wherever it is offered. To lock a document rather than an account, a strong passphrase works well with Protect PDF, which encrypts the file with a password you choose.