ToolMint
Developer Tools5 min readMay 17, 2026

How to Create a Strong Password – Length, Entropy & Best Practices

Most password advice is wrong or outdated. The old rules — add a capital letter, a number, and a symbol — produce predictable patterns like Password1! that are easier to crack than a longer random string. Modern password security is about entropy: the mathematical measure of unpredictability. This guide explains what actually makes a password strong.

What Makes a Password Strong: Entropy

Password strength is measured in entropy bits. The formula: entropy = log₂(charset size ^ length) Charset sizes: • Lowercase only (a–z): 26 characters • Lowercase + uppercase: 52 characters • Alphanumeric (a–z, A–Z, 0–9): 62 characters • Full printable ASCII (including symbols): 94 characters Entropy examples: • 8-char password, lowercase only: log₂(26⁸) = 37.6 bits — very weak, crackable in seconds • 8-char password, full charset (94): log₂(94⁸) = 52.4 bits — weak, crackable in hours with GPU • 12-char password, full charset: log₂(94¹²) = 78.6 bits — strong • 16-char password, lowercase only: log₂(26¹⁶) = 75.3 bits — comparable to 12-char full charset • 20-char password, lowercase only: log₂(26²⁰) = 94.1 bits — very strong Conclusion: length contributes more entropy than adding character types. A 20-character lowercase random string (94 bits) is stronger than a 12-character full-charset string (78.6 bits).

The NIST 2024 Password Guidelines

The US National Institute of Standards and Technology updated its password guidelines in 2024 (NIST SP 800-63B). Key changes from old advice: Stop requiring periodic rotation: forcing users to change passwords every 90 days leads to weaker passwords (people increment a number or flip a letter). NIST now recommends only changing passwords when there is evidence of compromise. Stop requiring complexity rules: mandatory uppercase + number + symbol requirements produce predictable substitutions (P@ssw0rd, Iloveyou1!). Random length matters more. Do require minimum length: at least 8 characters for user-created passwords, 6 for OTPs. Support up to 64+ characters to allow long passphrases. Do check against known breached passwords: reject passwords that appear in data breach databases (HaveIBeenPwned API). A 15-character password that appeared in a breach is weaker than an obscure 10-character one. Use a password manager: the only practical way to have unique, random, long passwords for every service.

Passphrases: Long, Memorable, and Secure

A passphrase is a sequence of random words: correct-horse-battery-staple (from the famous XKCD comic). Four random words from a 7,776-word list (standard dice ware wordlist) gives log₂(7776⁴) = 51.7 bits of entropy. Five words gives 64.6 bits — as strong as a 12-character random character password. The advantage: passphrases are much easier to remember and type than random character strings. For passwords you must type from memory — laptop login, password manager master password, Wi-Fi password, encrypted disk — a passphrase is the best choice. For everything else, generate a 16–20 character random string and store it in a password manager. You do not need to remember it — the manager does.

Password Security Best Practices in 2025

1. Use a different password for every account. If one site is breached, unique passwords prevent attackers from accessing other accounts with the same credentials. 2. Use a password manager (Bitwarden, 1Password, KeePass). This is the single most impactful change most people can make. 3. Enable two-factor authentication (2FA) on important accounts. A strong password + 2FA is far more secure than a perfect password alone. 4. Check if your email has appeared in breaches at haveibeenpwned.com. If yes, change the password for that service immediately. 5. Generate passwords with a CSPRNG. Do not make up passwords mentally — human-chosen passwords are predictable even when they feel random. The ToolMint Password Generator uses the Web Crypto API (crypto.getRandomValues), which is a cryptographically secure random number generator.

Try the tools mentioned in this guide

Password GeneratorGenerate cryptographically secure passwords (up to 128 chars) or passphrases with entropy score using Web Crypto API.JSON FormatterBeautify, validate, minify, and convert JSON to XML, CSV, or YAML — with inline error location on parse failure.Base64 Encoder/DecoderEncode text or files (images, PDFs, binary) to Base64 and decode Base64 strings back to plain text — UTF-8 safe.

Frequently Asked Questions

How long should a password be in 2025?
At least 12–16 characters for standard accounts. For high-value accounts (email, banking, password manager master password), use 20+ characters or a 5-word passphrase. Length matters more than complexity.
Is a random 12-character password stronger than a long sentence I made up?
Usually yes. Human-chosen phrases, even long ones, are not random — they follow patterns, reuse common words, and are predictable to password cracking tools trained on natural language. A 12-character password from a CSPRNG is genuinely random and harder to crack than most human-chosen phrases.
Should I use the same password for multiple sites?
Never. Password reuse is one of the biggest security risks. When any site is breached (and breaches happen constantly), attackers use 'credential stuffing' — trying the same email/password combination on hundreds of other sites. A password manager makes it easy to use unique passwords everywhere.

Related Guides

What Is Base64 Encoding? A Plain-English Explanation with Examples

Base64 converts binary data into a string of 64 printable characters so it can travel through systems that only handle text. Here is exactly how it works and when to use it.

How to Validate JSON Online – Common Errors and How to Fix Them

Most JSON validation errors come from five causes: trailing commas, missing commas, single-quoted strings, unquoted keys, and mismatched brackets. Here is how to find and fix each one.

All guidesBrowse all tools