How to generate a password
- Set the length. 16 or more characters is a good default for important accounts.
- Choose which kinds of characters to include.
- Copy the password straight into your password manager or the sign-up form.
- Need several? Pick how many and copy them all at once.
How long would it take to crack?
Assuming an attacker who can try 100 billion guesses a second against a leaked, fast-hashed password database, a truly random password holds out for roughly:
| Password | Entropy | Time to crack |
|---|---|---|
| 8 characters, all types | ≈ 52 bits | About 6 hours |
| 12 characters, all types | ≈ 79 bits | About 200,000 years |
| 16 characters, all types | ≈ 105 bits | Longer than the age of the universe |
| 20 lowercase letters | ≈ 94 bits | Longer than the age of the universe |
Length matters most: each extra character multiplies the work. Human-chosen passwords are far weaker than these figures.
Good password habits
- Use a different password for every account, so one leak can't unlock the rest.
- Store them in a password manager instead of memorising or reusing them.
- Turn on two-factor authentication wherever it's offered.
Common uses
- Signing up for a new account. Generate a long random password for the new account and save it straight into your password manager, so you never have to remember it.
- Replacing a leaked password. If a site reports a breach, change your password there to a fresh random one so the old one is useless to anyone who has it.
- A Wi-Fi password people will type. Turn on Avoid look-alikes for a router or guest Wi-Fi password that people will copy from a printed card.
- Setting up several accounts. Need passwords for a batch of new staff or test accounts? Choose 5, 10 or 25 under How many and copy them all at once.