How Strong Does a Password Need to Be? A Free Online Tools Guide
Most password advice is folklore dressed as engineering. People still believe that swapping letters for symbols makes a password strong, or that changing it every three months keeps attackers out. The truth is simpler and more numerical: a password’s real strength is measured in bits of entropy, which is just a count of how many guesses an attacker must make before they expect to find yours. Free online tools can calculate that number in a browser, but only if you understand what the number means and what it ignores.
At siteb.biz we list free online tools that run entirely in your browser, including password generators and entropy checkers that never upload your secret. This guide explains the arithmetic behind the rating, shows why length dominates complexity, and tells you when even the best browser-based checker is the wrong place to put a high-value credential.
Entropy in plain English#
Entropy is not a magic score; it is the logarithm of the number of possible passwords of a given length and character set. If your alphabet has N symbols and your password is L symbols long, there are N^L possibilities, and the entropy is L × log₂(N) bits. Each extra bit doubles the attacker’s expected work. A totally random eight-character password from the 95 printable ASCII characters has about 52.6 bits of entropy. That sounds high until you learn that a single modern GPU can test tens of billions of hashes per second.
| Character set | Symbols | Bits per symbol |
|---|---|---|
| Lowercase a–z | 26 | ~4.7 |
| Lowercase + uppercase | 52 | ~5.7 |
| Alphanumeric | 62 | ~5.95 |
| All printable ASCII | 95 | ~6.57 |
| Diceware word list | 7,776 | ~12.9 |
These figures assume the password is chosen randomly; human-chosen passwords usually have far less entropy.
Why length beats symbol substitution#
Security trainers used to praise passwords like P@ssw0rd1 because they contained uppercase, lowercase, digits and symbols. Modern rule-based crackers model those exact substitutions before they ever try brute force. Hashcat and John the Ripper come with ‘leetspeak’ rules that turn ‘password’ into ‘P@ssw0rd’, ‘Passw0rd!’ and hundreds of siblings in milliseconds. Adding a symbol to a short, predictable base is decoration, not structure. It may satisfy an outdated policy, but it does not meaningfully change the attack path.
- Replace ‘a’ with ‘@’ and ‘o’ with ‘0’
- Append the digit 1 or the current year
- Capitalise the first letter and add an exclamation mark at the end
- Run keyboard walks such as ‘qwerty’ and ‘1q2w3e’
- Combine a dictionary word with a single digit or symbol
If your password is on a leaked list, no amount of symbol swapping will help; the attacker already has it.
The offline crack in numbers#
When a service is breached and its password database leaks, the attacker works offline. They can rent hardware, try guesses for days, and never trigger a lockout. The table below shows how long a single mid-range GPU (roughly 40 billion SHA-256 guesses per second) would need to exhaust the key space of random passwords. Real attacks stop early because users cluster around common patterns, but the table shows the theoretical ceiling for fully random credentials.
| Length / form | Character set | Time to exhaust offline |
|---|---|---|
| 8 characters | Lowercase a–z only | < 10 seconds |
| 8 characters | All 95 printable ASCII | ~2 days |
| 10 characters | All 95 printable ASCII | ~50 years |
| 12 characters | All 95 printable ASCII | ~400,000 years |
| 16 characters | All 95 printable ASCII | ~10^13 years |
| 6 random words | 7,776-word Diceware list | ~150,000 years |
These figures ignore early hits from common patterns; they are worst-case for the attacker, best-case for you.
What a leaked-database attack really looks like#
Attackers rarely ‘guess’ a password through a login form. They download a stolen database, identify the hash algorithm, and run it at hardware speed. The first pass uses previously leaked passwords, then dictionary words with leet rules, then masks for known patterns, and finally brute force for the shortest credentials. A single leaked password from Site A is then tried on Site B, Site C and Site C’s banking partner because people reuse. A cloud GPU instance costs €0.50–€4.00 per hour depending on whether you rent a consumer card or a cluster, and the whole workflow is automated.
- Obtain the hashed password database from a breach or purchase it on a forum.
- Identify the hash algorithm and whether a unique salt was used.
- Run a wordlist plus rules; this cracks 60–80% of typical user passwords within hours.
- Apply brute force or masks to the remainder, starting with short lengths.
- Use recovered credentials for credential-stuffing attacks against other services.
Salting and slow hashes such as Argon2 or bcrypt make this far slower, but many older sites still use fast algorithms like SHA-1 or MD5.
NIST’s revised advice on rotation and complexity#
The US National Institute of Standards and Technology withdrew the old ‘change every 90 days’ rule in SP 800-63B. It now says password policies should require a minimum length, allow long passphrases, and reject passwords known to be compromised. Complexity rules that demand uppercase, lowercase, digit and symbol are no longer recommended, because they encourage predictable mutations such as P@ssw0rd1 and do not improve entropy. Rotation is only required when there is evidence of compromise.
- Minimum length is more important than character-class requirements.
- Do not force periodic changes unless a breach is suspected.
- Screen new passwords against lists of compromised credentials.
- Allow paste and password managers, which enable longer, unique passwords.
- Use multi-factor authentication rather than relying on passwords alone.
These are US federal guidelines, but they have been widely adopted by security standards bodies worldwide.
When a browser-based tool is enough, and when it is not#
A password generator that runs entirely in your browser can produce excellent randomness and never sees your secret. That makes it useful for one-off accounts, temporary keys, or checking the entropy of a candidate password. It is not the right place to create or store the master password for your password manager, your cryptocurrency seed, or the admin key to a business system. For those, use a vetted native password manager or offline process. A reputable password manager costs €20–€60 per year depending on features and family plans. Free online tools are conveniences, not vaults.
- Use a browser-based generator for short-lived or low-risk passwords.
- Use a dedicated password manager for banking, email, and primary accounts.
- Do not paste a real master password into any online checker, even one that claims no upload.
- Store recovery codes on paper or in encrypted storage, not in a notes app.
- For shared business credentials, use an enterprise password manager with audit logs.
siteb.biz lists tools on their own subdomains and writes these guides; we do not provide the service ourselves, so judge each tool by its privacy policy and whether it runs client-side.
A practical minimum for 2025#
For accounts you care about, use a password manager to create and store a unique password of at least 16 characters drawn from the full printable set, or a passphrase of at least five random words. Turn on multi-factor authentication, ideally using an authenticator app or hardware key rather than SMS. Check whether your email appears in known breaches through Have I Been Pwned, and change any password that is reused or compromised. Treat password strength as one layer in a larger risk decision, not a guarantee.
- Use 16+ random characters or 5+ random words for high-value accounts.
- Enable multi-factor authentication on email, banking, and password-manager accounts.
- Never reuse a password across services.
- Check breach-notification services and rotate only compromised credentials.
- Prefer a hardware security key or authenticator app over SMS codes.
A longer, memorable passphrase is usually stronger than a short complex password you have to write down.
Frequently asked questions
Is a 12-character password with symbols strong enough?
It depends on how it was created and what you are protecting. Twelve fully random characters from the full printable set give roughly 77 bits of entropy, which would take a single GPU hundreds of thousands of years to exhaust offline. However, if the base is a dictionary word with symbols added for decoration, modern rule sets will crack it in minutes. For high-value accounts such as email, banking, or your password manager, 16 random characters or five random words is a safer minimum, and multi-factor authentication is essential.
Are free online password generators safe to use?
They can be, if they run entirely in your browser and do not upload the password or log keystrokes. The best tools use the browser’s built-in cryptographically secure random number generator and work without a login. They are fine for generating one-off passwords or estimating entropy. They are not the right choice for creating a master password, a cryptocurrency seed, or any secret you will store long term. For those, use an audited native password manager or an offline process, and never paste a real master password into an online form.
Why did NIST stop recommending password rotation?
Research showed that forced rotation every 60 or 90 days produced weaker security, not stronger. Users responded by making tiny, predictable changes such as Password1, Password2, Password3, or by writing passwords down. NIST SP 800-63B now advises against mandatory periodic changes unless there is evidence that the password has been compromised. Instead, organisations should enforce minimum length, allow long passphrases, screen new passwords against breach lists, and require multi-factor authentication.
how strong should my password bepassword entropy calculatorfree online password generatorNIST password guidelines 2024how long should a password bepassword cracking time calculator
