Password Strength by the Numbers
Password strength is measured in bits of entropy. Each bit doubles the number of possible passwords an attacker must try. Here's what different entropy levels mean in practice:
Under 40 bits: Cracked in seconds to minutes. Common passwords, short PINs, simple patterns.
40-59 bits: Cracked in hours to days. Short passwords with mixed character types.
60-79 bits: Cracked in years to decades. Moderate random passwords, 5-word passphrases.
80-127 bits: Cracked in centuries to millennia. Strong random passwords, 6-7 word passphrases.
128+ bits: Effectively uncrackable. Beyond brute force capability of any known technology.
Why 16+ Characters Is the New Baseline
In 2020, 8 characters was considered acceptable. By 2025, GPU cracking speeds have made 8-character passwords trivially breakable. NIST, OWASP, and security researchers now recommend 16 characters minimum for important accounts. Our generator defaults to 16 characters with all character types — providing approximately 105 bits of entropy. That would take longer than the age of the universe to crack with current technology.