Length beats complexity
A twenty-character password made only of lowercase letters is far harder to break than an eight-character password crammed with symbols. Each extra character multiplies the search space; adding one symbol type merely widens it slightly.
Practical guidance: 16 characters minimum for ordinary accounts, 20 or more for email, banking, domain registrars and anything that can reset other passwords.
Reading the entropy figure
| Entropy | Assessment |
|---|---|
| Under 50 bits | Weak — crackable by a determined attacker |
| 50 – 70 bits | Reasonable for low-value accounts |
| 70 – 90 bits | Strong for everyday use |
| Above 90 bits | Strong enough for anything you own |
The habits that matter more than the password
- Never reuse. One breach on a forum becomes a breach everywhere the same password was used. Credential stuffing is automated and cheap.
- Use a password manager. Bitwarden, 1Password or your browser's built-in manager. A manager you actually use beats a perfect system you abandon.
- Turn on two-factor authentication wherever it is offered, and prefer an authenticator app over SMS.
- Protect email first. Whoever controls your email can reset almost everything else.
- Do not rotate for the sake of it. Forced periodic changes push people toward predictable variations. Change when there is a reason.
For businesses
Shared logins are the most common weak point in small Indian businesses — one WhatsApp Business account, one Google Ads login, one bank portal, all with a password three people know and nobody changes when someone leaves. A team password manager with per-person access and a removal step in your offboarding checklist fixes most of that exposure at negligible cost.
Frequently asked questions
Are these passwords safe to use?
Yes. They are generated locally using the browser's cryptographic random source and are never transmitted or logged.
How long should a password be?
At least 16 characters for everyday accounts and 20 or more for email, banking and anything that can reset other credentials.
Should I change passwords regularly?
Only when there is a reason — a breach, a departing employee, or a suspicion of compromise. Scheduled rotation tends to produce weaker, more predictable passwords.