What actually makes a password strong?
Length, then unpredictability — in that order. Each additional character multiplies the number of possible combinations, so a 16-character password drawn from a large character set is astronomically harder to crack than an 8-character one, regardless of how clever the substitutions are. Adding symbols and mixed case widens the alphabet, which helps, but doubling length helps far more. The classic advice to swap letters for symbols produces passwords that are hard for humans and easy for machines.
How is password entropy measured?
In bits, calculated as length multiplied by the base-2 logarithm of the character-set size. A 12-character password from the 94 printable ASCII characters carries about 78 bits. Under 40 bits is weak, 60–80 is reasonable for most accounts, and above 100 is strong enough that brute force is not the realistic attack. Entropy assumes genuine randomness — a password you invented yourself has far less than its length suggests, because human choices cluster.
Are passphrases better than random strings?
Often yes, in practice. Four or five random words from a large dictionary give comparable entropy to a shorter random string while being memorable enough to type without a manager. The critical word is random: words you choose yourself, or a phrase from a song or book, are weak because attackers use exactly those sources. Diceware-style selection from a wordlist is what makes the method work.
How often should I change my passwords?
Guidance has shifted substantially. Forced rotation on a schedule is no longer recommended by NIST or the UK's NCSC, because it pushes people toward small predictable variations — Summer2024 becoming Autumn2024. Change a password when there is a reason: a breach notification, a shared credential, a device you no longer control, or any suspicion of compromise. Otherwise a long unique password is better left alone.
Is it safe to generate a password in a browser?
It depends where the generation happens. This generator runs entirely in your browser using the Web Crypto API — nothing is transmitted, logged or stored on any server, and closing the tab discards it. Generators that produce passwords server-side are a different proposition, because the password existed somewhere outside your control. If you cannot tell which kind you are using, assume the worse case.
What should I do with the password once generated?
Put it straight into a password manager rather than trying to remember it — a unique long password per account is only practical with one. Enable two-factor authentication wherever it is offered, because it protects you even if the password leaks. And avoid emailing or messaging credentials to yourself: those copies persist in places you will forget about, long after the password matters.