Most password advice boils down to a single principle: the strength of a password is measured by its entropy — the number of possible combinations an attacker would have to try. More entropy means exponentially longer brute-force times, and the cheapest way to buy entropy is length.
Length beats complexity
Each extra character multiplies the search space by the size of the character set. A 16-character password drawn from 72 possible symbols has roughly 106 bits of entropy — trillions of times more combinations than an 8-character one. That's why security experts consistently recommend long passphrases over short, symbol-stuffed ones.
The 16-character rule of thumb
A randomly generated 16-character mixed password defeats brute force far beyond any practical timeframe. Make it 20+ if you want headroom for the future.
Crack-time estimates, demystified
Crack-time estimates translate entropy into plain English — "about 3 centuries" instead of 106 bits. They assume a powerful attacker using GPUs, so treat them as a lower bound. If your password rates in centuries, it's strong enough; if it rates in hours, regenerate it.
ForgePlug's Password Generator shows both numbers live: an entropy-based strength meter and a crack-time estimate that updates as you change length or character sets. It uses your browser's cryptographically secure random API — the same source operating systems use — so results can't be predicted, and nothing you generate ever leaves your device.
Generate a strong password
Choose length and character sets, watch the strength meter and crack-time estimate in real time, then copy straight into your password manager.
Open Password GeneratorWhat actually breaks passwords
- Reuse — one breached site leaks the password everywhere else you used it.
- Dictionary words — "correcthorse" style phrases are only safe when truly random.
- Patterns — 123456, qwerty, and year-of-birth suffixes are guessed first.
- Phishing — no amount of entropy helps if you type it into the wrong site.