Decades of password rules trained people to turn password into P@ssw0rd! and feel safer. Attackers know those substitutions perfectly well. What actually resists guessing is the number of possibilities an attacker must work through, and length raises that faster than anything else.
Entropy, in one paragraph
Entropy measures how many possible passwords your generation method could have produced, expressed in bits: each extra bit doubles the work. A random 12-character password from a 94-character alphabet carries about 79 bits — roughly 10^23 possibilities.
The crucial word is random. Entropy describes the process, not the string. A password you invented has far less entropy than its length suggests, because human choices cluster hard around familiar patterns, and cracking tools model those patterns explicitly.
Why length wins
Adding a character multiplies the search space by the alphabet size. Adding a character class merely widens the alphabet a little. Going from 12 to 16 random characters is a far larger gain than adding punctuation to 12.
This is why the old complexity rules backfired. Forcing a symbol and a digit into a short password produced predictable results — a capital at the front, a digit and a bang at the end — while making passwords annoying enough that people reused them.
Reuse is the real risk
Most accounts are not lost to brute force. They are lost because a password was reused, one unrelated site was breached, and the same pair was tried everywhere else. A strong password used in two places is weaker than two mediocre ones.
Which makes a password manager the actual answer: it removes the reason to reuse. Generate a long random password per site, let the manager remember it, and turn on two-factor authentication where it is offered.
In short
Generate randomly, prefer length over punctuation, and never reuse. If you remember your passwords, you have too few of them.
Password Generator
Create strong random passwords with real entropy figures, generated locally and never transmitted.
Keep reading
UUID v4 vs v7: which one belongs in your database?
Random UUIDs scatter writes across an index. Time-ordered v7 fixes that, at the cost of revealing creation time — how to choose between them.
MD5, SHA-1, SHA-256: which hash should you actually use?
What it means for a hash to be broken, why fast hashes are the wrong tool for passwords, and how to verify a downloaded file properly.
Base64 explained: what it's for, and what it is not
Base64 is an encoding, not encryption. What it actually solves, why it makes data a third larger, and when embedding a data URI is a mistake.