For years, the standard password advice was "8+ characters, mix uppercase, lowercase, numbers, and symbols." That advice is now widely considered outdated by security researchers — not wrong exactly, but focused on the wrong variable. The property that matters most for resisting a brute-force attack is length, not character-set complexity.
Why length matters more than complexity
The number of possible passwords grows exponentially with length and only linearly-ish with character-set size. An 8-character password using a large 94-character set (upper, lower, digits, symbols) has about 94^8 ≈ 6 quadrillion combinations. A 16-character password using only lowercase letters (26 characters) has 26^16 ≈ 4 x 10^22 combinations — roughly seven million times more. Length wins by an enormous margin, because each additional character multiplies the search space, while adding a character set only multiplies it once.
This is also why passphrases (correct-horse-battery-staple style, four or five random unrelated words) have become popular: they're easy to remember and type, but because they're long, they're extremely hard to brute-force — despite "failing" the old complexity checklist.
What actually breaks passwords in practice
- Reuse across sites — a breach on one low-security site exposes the password for every other account using it. This, not brute-force, is the single biggest real-world cause of account compromise.
- Dictionary and pattern attacks — attackers don't try every combination blindly; they try common words, names, keyboard patterns (qwerty123), and known-breach password lists first. A password's resistance to a dictionary attack matters more than its resistance to pure brute force.
- Predictable substitutions — replacing "a" with "@" or "o" with "0" is well known to attackers and is baked into modern cracking tools; it barely adds real entropy anymore.
What a good generated password actually needs
- At least 16 characters for anything important — longer for high-value accounts
- True randomness, not a pattern a human would choose — this is exactly what a password generator is for; humans are bad at generating randomness even when trying to
- Unique per site, always — a password manager makes this practical; memorizing dozens of 16+ character random strings isn't realistic, and it shouldn't be the plan
- Symbols and mixed case are still fine to include — they don't hurt, they're just not the main lever
The generator below produces cryptographically random passwords using the Web Crypto API (not Math.random(), which is not secure for this purpose) directly in your browser — nothing is transmitted or logged. Set the length to 16+ characters, generate a unique one per account, and store them in a password manager rather than trying to memorize variations of the same base password.