Creating Secure Passwords: Entropy, Length, and Best Practices

What Makes a Password Strong?

A strong password resists guessing—whether by a human who knows something about you or by a computer that can try billions of combinations per second. The two factors that determine password strength are length and randomness. Together, they define a measurable property called entropy.

The classic advice—“use a mix of uppercase, lowercase, numbers, and symbols”—isn’t wrong, but it’s incomplete. A password like P@ssw0rd! satisfies all those rules yet is trivially crackable because it follows predictable patterns. Real strength comes from high entropy, not from checking boxes on a complexity policy.

You can generate cryptographically strong passwords with the Password Generator on CodeKit.

Understanding Entropy

Entropy, measured in bits, quantifies how unpredictable a password is. Each bit of entropy doubles the number of guesses an attacker needs in a brute-force attack.

The Formula

Entropy (bits) = log₂(R^L) = L × log₂(R)

Where:

• R = size of the character pool (the alphabet)
• L = length of the password

Character Pool Sizes

Character Set	Pool Size (R)	Entropy per Character
Digits (0–9)	10	~3.32 bits
Lowercase letters (a–z)	26	~4.70 bits
Uppercase + lowercase	52	~5.70 bits
Alphanumeric (a–z, A–Z, 0–9)	62	~5.95 bits
Alphanumeric + common symbols	~95	~6.57 bits

Calculating Entropy in Practice

An 8-character password using all 95 printable ASCII characters:

Entropy = 8 × log₂(95) = 8 × 6.57 ≈ 52.6 bits

A 16-character password using only lowercase letters:

Entropy = 16 × log₂(26) = 16 × 4.70 ≈ 75.2 bits

The second password has significantly more entropy despite using a smaller character set, because length matters more than complexity. This is the single most important insight in password security.

How Much Entropy Is Enough?

Entropy (bits)	Time to Crack (approximate)	Assessment
28	Seconds	Trivially weak
36	Minutes	Very weak
48	Hours to days	Weak
60	Months to years	Moderate
80	Centuries (current hardware)	Strong
100+	Infeasible	Very strong

These estimates assume offline attacks where the attacker has the hashed password and can try billions of guesses per second using GPUs or ASICs. For online attacks (trying passwords against a live login), rate limiting and lockout policies make even moderate entropy sufficient—but you should always design for the offline scenario.

Length vs. Complexity

The math is clear: adding length increases entropy faster than adding character variety. Here’s a comparison:

Password Pattern	Length	Pool	Entropy
abcdefgh	8	26	37.6 bits
aB3! style (mixed)	8	95	52.6 bits
abcdefghijklmno	15	26	70.5 bits
aB3! style (mixed)	12	95	78.8 bits
abcdefghijklmnopqrstuvwxyz012345	32	26	150.4 bits

A 15-character lowercase password (70.5 bits) is stronger than an 8-character fully random password (52.6 bits). And a 32-character lowercase password is essentially uncrackable with current technology.

This insight leads to the passphrase approach: instead of Tr0ub4dour&3, use correct-horse-battery-staple. Four random words from a dictionary of 6,000 words gives you:

Entropy = 4 × log₂(6000) = 4 × 12.55 ≈ 50.2 bits

Five words push this to ~62.7 bits, and six words to ~75.3 bits—all while being far easier to remember and type than a jumble of symbols.

Common Password Mistakes

1. Substitution Patterns

Replacing e with 3 or o with 0 is so common that cracking tools try these substitutions automatically. P@ssw0rd is not meaningfully stronger than Password.

2. Keyboard Walks

qwerty, asdfgh, zxcvbn, and their variants appear in every cracking dictionary. They add almost no entropy.

3. Personal Information

Names, birthdays, pet names, and favorite sports teams are all guessable. An attacker who knows anything about you—or who has seen a social media profile—will try these first.

4. Reusing Passwords

If you use the same password on multiple sites, a breach on any one of them compromises all the others. This is the most common way accounts get hijacked: not by cracking your password, but by finding it in a leaked database from a different service.

5. Relying on “Complexity” Rules Alone

Many password policies require uppercase, lowercase, digits, and symbols. Users respond predictably: they capitalize the first letter, add a number at the end, and maybe append !. This produces passwords like Summer2025! that satisfy the policy but are easy to crack because they follow predictable patterns.

Generating Strong Passwords

The most reliable way to create a strong password is to generate it randomly. Here’s how different methods compare:

Cryptographic Random Generators

The gold standard. Use a CSPRNG (Cryptographically Secure Pseudo-Random Number Generator) to select characters from your desired pool:

function generatePassword(length, charset) {
  const array = new Uint32Array(length);
  crypto.getRandomValues(array);
  return Array.from(array, n => charset[n % charset.length]).join('');
}

const charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*';
console.log(generatePassword(20, charset));
// Example output: "mK8#xR2!pL5vN9@hQ3wT"

Diceware Passphrases

Roll physical dice to select words from a standardized word list. This method is completely offline and verifiable:

5 dice rolls → word index → word
6 words → ~77 bits of entropy

Password Managers

Password managers generate and store unique, random passwords for each service. You only need to remember one strong master password. This is the most practical approach for most people.

Password Strength Checkers: How They Work

Online password strength checkers typically estimate entropy by analyzing:

1. Character pool size: Which character sets are represented?
2. Length: Total number of characters
3. Pattern detection: Does the password follow common patterns (dictionary words, keyboard walks, dates, repeated characters)?
4. Dictionary matching: Is the password (or a component of it) found in common password lists?

A good strength checker penalizes predictable patterns. The password Password1! scores high on raw entropy calculations but should be flagged as weak because it matches a known pattern.

Best Practices Summary

• Use at least 12 characters for random passwords, or 5+ words for passphrases
• Generate randomly—don’t invent passwords by hand
• Use a unique password for every account—a password manager makes this feasible
• Enable multi-factor authentication (MFA) wherever possible—passwords alone are not enough
• Don’t share passwords—use shared credential managers for team access
• Change passwords after a breach—not on a fixed schedule (forced rotation leads to weaker passwords)
• Prefer longer passwords over complex ones—length wins every time

Conclusion

Password security comes down to entropy—how many guesses an attacker needs. Length contributes more to entropy than character complexity, which is why passphrases and long random passwords outperform short complex ones. The best strategy is to use a password generator for every account, store them in a password manager, and protect critical accounts with MFA.

Need a strong password right now? Use the Password Generator on CodeKit to create cryptographically random passwords with customizable length and character sets—all generated locally in your browser.