How to Generate a Strong Password (and Actually Know It's Strong)

Two things are commonly wrong with how people think about password strength. First, "cleverness" — swapping letters for numbers, adding a "!" at the end — barely helps, because password-cracking tools have known these substitution patterns for over a decade and check for them automatically. Second, most of the little colored strength bars on signup forms are running crude heuristics (length plus character variety), not anything close to a real security estimate.

What actually makes a password strong

Two things, in order of importance: length, and true randomness. A 16-character string of genuinely random characters is dramatically harder to crack than a 10-character "clever" substitution password, even one that looks complex to a human eye. The reason is pure math — each additional random character multiplies the search space, while substitution patterns barely register against a modern cracking tool that already accounts for them.

"True randomness" matters specifically because humans are bad at being random on purpose. Left to pick "random" characters, people unconsciously favor certain patterns (common substitutions, keyboard-adjacent characters, patterns that feel random but aren't). Real password generation needs to come from a cryptographically secure random source, not a human trying to mash the keyboard unpredictably.

What an honest strength checker looks like

Not a colored bar based on "did you include a number." A real strength check should account for actual entropy — how large is the space of possible passwords this could be, given its length and character set — and be honest when a password is weak even if it LOOKS complicated, or honest when a password is strong even if it's "just" a long random string with no special characters.

Password Toolkit generates real cryptographically-random passwords and checks strength based on actual entropy, not a guess.