Password strength without the scare charts

Password advice is often louder than it is useful. Charts with “hacker faces” and color-coded meters can make people feel informed without explaining the actual lever: how many guesses an attacker must try.

Entropy is a rough measure of that search space. You do not need a cryptography seminar to use it well. You need length, randomness, and a generator that does not phone home.

Length is the main dial

Adding a few characters usually helps more than swapping one symbol for another. A short password with mixed classes can still be weaker than a longer passphrase built from random words or a long random string from a generator.

Practical defaults for machine-generated secrets:

• 16+ characters for most accounts when a password manager will store it
• 20+ characters for higher-value targets (email, cloud consoles, financial)
• Prefer random generation over human invention

Humans are bad at inventing unpredictability. Generators are not.

Character classes are options, not theater

Uppercase, lowercase, digits, and symbols expand the alphabet. That helps, but only if the generator actually samples from them. Requiring “at least one of each” on a short password can accidentally make the space smaller by constraining positions.

Better pattern: choose a solid length, include the classes your policy demands, and let a cryptographically strong source pick the characters.

UtilInUse’s password generator runs in the tab. Choose length and classes, generate, copy, and close. Nothing is stored as a side effect of generating.

Passphrases versus random strings

Passphrases (several random words) are easier to type when you must enter them by hand. Random strings win when a password manager fills them. Both can be strong if the selection is random and long enough.

Avoid:

• Quotes from movies
• Pet names with a year glued on
• Keyboard walks (qwerty…)

Those patterns are in attacker dictionaries.

Where local generation matters

A password you generate on a remote site briefly exists on that site’s infrastructure — even if the marketing page says otherwise. Generating locally removes that step. Pair local generation with a reputable password manager for storage and autofill.

A calm checklist

1. Use a manager
2. Generate long random secrets
3. Unique password per site
4. Turn on MFA where it exists
5. Prefer local generators for the minting step

Strength is mostly process. Entropy math just explains why the process works.