Password Generator

Length beats complexity, and it is not close

Decades of password advice pushed complexity — a capital here, a digit there, a symbol substituted for a letter — and the maths simply does not support it. Each additional character multiplies the number of possible passwords by the size of the character set, so length grows the search space exponentially while adding one more symbol type grows it only linearly. This is why 'correcthorsebatterystaple' is dramatically stronger than 'P@ssw0rd!' despite looking far less like what a password is supposed to look like. It is also why the composition rules that forced everyone to append '1!' to a dictionary word achieved so little: attackers know exactly what those rules produce, and they guess accordingly.

Reuse is the real vulnerability

The strength of an individual password matters far less than most people assume, because passwords are very rarely broken by brute force. They are stolen — from a breached service, through a phishing page, or from malware on a device. Once an attacker holds your email address and one password, the first thing they do is try that pair on every significant service in existence, an attack so routine it has a name: credential stuffing. A single reused password turns one company's breach into a compromise of your email, your bank and your cloud storage. This is precisely why a password manager is more valuable than any amount of cleverness in password construction: it makes every password unique, so a breach stays contained to the one service that leaked it.