Strong passwords, in a click.

Why length beats complexity, and what actually stops an attack

The advice most people absorbed — a capital, a number, a symbol — optimises the wrong variable. What resists guessing is the number of possibilities, and that grows far faster with length than with variety. A password drawn from lowercase letters and digits has 36 options per character, so twelve characters gives 36¹², around 4.7 sextillion combinations. Adding uppercase and symbols to reach 94 options but keeping it at eight characters gives 94⁸ — roughly 6 quadrillion, which is about a million times smaller. The longer, simpler one wins comfortably.

The other reason complexity rules disappoint is that everyone follows them the same way. Capital at the front, digit and exclamation mark at the end, o replaced with zero, a replaced with @. Cracking tools have applied those substitutions as standard since the 2000s, so "P@ssw0rd!" is barely harder to break than "password". A rule that everybody obeys identically stops being a source of randomness.

This is also why a passphrase works. Four or five genuinely random common words are long, memorable and easy to type on a phone — and the strength comes from the words being chosen at random rather than from the sentence sounding unusual. Picking them yourself defeats it, because human "random" choices cluster heavily around the same few thousand words.

None of it matters as much as one thing: using a different password on every site. The most common way accounts fall is not brute force at all — it is credential stuffing, where a password leaked from one breached site is tried automatically against everyone else. A perfect password reused in three places is a weakness in all three the moment any one of them leaks. That is the argument for a password manager, and it is the reason generated passwords are worth the inconvenience of not being memorable.

The passwords here are generated with the Web Crypto API's getRandomValues — the browser's cryptographic random source, the same primitive behind HTTPS and most password managers, not the ordinary pseudo-random function. Generation happens entirely in the page: the password is never sent anywhere, and closing the tab is enough to be rid of it.