Quick answer: A 16-character password from 86 characters (letters, digits and 24 symbols) has 16 × log₂(86) = 102.8 bits of entropy, which is strong.
How it's calculated
Entropy measures how hard a random password is to guess: entropy = length × log₂(pool), where the pool is the number of characters each position can be. Every extra bit doubles the number of guesses an attacker needs.
Strength here is a rough guide by entropy: under 60 bits weak, 60–79 fair, 80–111 strong, 112 and over very strong. For comparison, NIST retired 80-bit security for cryptographic keys and sets 112 bits as the current minimum.
The passwords are drawn from your browser's cryptographic random generator (crypto.getRandomValues), 256 bits per visit, with every character picked uniformly from the sets you choose. Length matters more than symbols: adding four characters adds more entropy than adding symbols to the pool.
Worked examples
- 16 characters, all four sets (86): 16 × log₂ 86 = 102.8 bits
- 12 characters, letters and digits (62): 12 × log₂ 62 = 71.5 bits
- 20 characters, lowercase only (26): 20 × log₂ 26 = 94.0 bits
Frequently asked questions
How do I get new passwords?
Reload the page: each visit takes fresh randomness from your browser's secure generator (crypto.getRandomValues).
How long should a password be?
NIST guidance asks services to allow long passwords and to check them against lists of breached passwords. A random password of 16 characters or more, kept in a password manager, is a common choice.
Is anything I type sent to a server?
No. The passwords are made in your browser and nothing leaves your device.
Do I need symbols for a strong password?
They help a bit, but length helps more. Twenty letters and digits (about 119 bits) beat twelve characters with symbols (about 79 bits).
Where should I keep my passwords?
In a password manager. It remembers a different strong password for every site and fills it in for you, so you never have to reuse one.
What does leaving out look-alikes do?
It drops characters people mix up, like I, l and 1 or O, 0 and o. Handy if you'll ever read the password out or type it by hand. The strength drops slightly because there are fewer characters to pick from.