Password entropy without the jargon

“Entropy” shows up in every password article and helps almost no one choose a better string. You do not need a lecture on information theory to generate a credential that survives stuffing, reuse, and offline guessing. You need length, an honest random source, and a generator that does not phone home.

This guide is the practical version. It maps the usual advice onto settings you can actually toggle, and it explains which knobs matter.

What attackers actually do

Most account takeovers are not someone typing guesses into a login form until dawn. They look like this:

• Credential stuffing. A password from another breach is tried against your email everywhere.
• Phishing. The password was strong; you typed it into the wrong page.
• Password-reset abuse. The secret never mattered; the inbox did.
• Offline hash cracking. A dumped database of hashes is attacked with GPUs. Here, length and unpredictability matter a great deal.

A generator cannot fix phishing or a weak reset flow. It can make stuffing useless (because the password is unique) and make dumped hashes expensive to crack (because the password is long and not in a dictionary).

That is the job: unique, long, and not chosen by a human brain.

Why humans are bad at this

People optimize for typing and memory. That produces patterns: keyboard walks, season-plus-year, a pet name with a ! at the end, the same base string with a site suffix. Crackers know those patterns. Wordlists encode them.

A passphrase of four common words can still be strong if the words are chosen from a large list with a CSPRNG. A “clever” mixed password of 10 characters that you invented is usually weaker than it looks. The gap is not intelligence. It is that your cleverness is correlated with everyone else’s cleverness.

So: do not invent. Sample.

Length first, then character set

If you remember one rule, remember this: extra length beats extra symbol drama.

A 12-character password from a mixed alphabet is already in a different league from an 8-character one. A 16- or 20-character password from letters and digits is typically enough for generated secrets stored in a manager. Adding punctuation helps per character, but not as much as adding four more characters.

Where symbols do still matter:

• Some older systems cap length at 8–12 characters. Then you need the densest alphabet the system allows.
• Some systems require a symbol or mixed case. Meet the policy; then add length if the field allows it.
• Do not add symbols if the system silently strips them or confuses O and 0 in a recovery PDF.

If a site rejects a long password, that is a site defect. Use the maximum it accepts and store the result in a manager. Do not “simplify” it into something memorable.

What “random” has to mean

Math.random() is not for secrets. Browser password tools should call crypto.getRandomValues (or equivalent Web Crypto). That API is designed for cryptographic sampling. A homemade new Date() seed is not.

You should also be wary of:

• Generators that show an ad network while displaying the password
• Generators that require an account or save a history
• Generators that send the result to a server “to check strength”

Strength meters that run locally on character classes are fine as UX. Strength meters that upload the candidate are not.

Toolio’s password generator runs in the tab. Choose length and classes, generate, copy, and close. Nothing is stored as a side effect of generating.

Passphrases versus “complex” strings

Two good outputs look different and can both be correct:

• vK7nQ2wL9pR4tX8b — high density, miserable to type, perfect for a manager.
• correct-battery-staple-style phrases — easier to type on a TV or a friend’s laptop, still strong if the words are sampled from a large list, not chosen as a sentence you like.

Use dense strings for services behind a password manager. Use a long sampled passphrase when you must type the secret on a limited keyboard and you understand the word list size. Do not reuse either.

Avoid:

• Quotes, lyrics, and movie titles
• Substitutions like P@ssw0rd
• A unique suffix on a shared stem (hunter2-bank, hunter2-mail)

A short checklist before you copy

1. Length at least 16 unless the site forbids it.
2. Generated, not edited into something pronounceable.
3. Unique to that account.
4. Copied into a password manager, not into email “for safekeeping.”
5. Generated on a page that did not upload the value.

If you are creating a password for a shared break-glass account, generate it locally, store it in the team’s approved vault, and rotate it when someone leaves. A screenshot in chat is not a vault.

Entropy, said plainly

When articles say “128 bits of entropy,” they mean: there are so many possible values that guessing is not a feasible strategy, assuming each character (or word) was sampled independently from a known set.

You do not need to compute logarithms in the browser. You need a generator that samples uniformly from the set you selected, and a length that makes the set enormous. If you tick “lowercase, uppercase, digits” and set length to 20, you are done for ordinary accounts.

The jargon was never the hard part. The hard part is not sending the sample to a server, not shortening it so you can remember it, and not recycling it because the next site “doesn’t matter.” Generate locally. Store properly. Move on.