What Makes a Password Secure?
Password security is measured in entropy — the number of possible combinations an attacker must try before guessing your password. Entropy is measured in bits, and each bit doubles the time required to brute force.
The formula is: E = log₂(C^L) where C is the size of the character set and L is the password length.
| Character Set | Pool Size (C) | 8-char Entropy | 12-char Entropy | 16-char Entropy |
|---|---|---|---|---|
| Lowercase only | 26 | 38 bits | 56 bits | 75 bits |
| Lowercase + digits | 36 | 41 bits | 62 bits | 83 bits |
| Mixed case + digits | 62 | 48 bits | 71 bits | 95 bits |
| All characters + symbols | 94 | 52 bits | 79 bits | 105 bits |
An entropy of 80+ bits is considered secure against even well-funded attackers. That means a 12-character password with all character types, or a 16-character password with mixed case + digits.
Password Best Practices
1. Use a Password Manager
You can't remember 100 unique 16-character passwords. Don't try. Use a reputable password manager like Bitwarden, 1Password, or KeePass. They generate and store strong passwords for each site, so you only need to remember one master password.
2. Never Reuse Passwords
Credential stuffing attacks take leaked passwords from one breach and try them on other sites. If you use the same password for your email and your bank, a breach at a low-security forum exposes both. Every account needs a unique password.
3. Enable Two-Factor Authentication
Even a strong password can be phished. 2FA adds a second factor — a TOTP code from an authenticator app, a hardware security key, or a biometric — so a compromised password alone isn't enough to log in.
4. Check Against Known Breaches
Before using a password, check if it appears in known data breaches using services like Have I Been Pwned. Our Password Generator creates fresh random passwords that have never been used before.
Try the ByteBox Password Generator
ByteBox's Password Generator uses window.crypto.getRandomValues() — the same cryptographically secure random number generator browsers use for TLS encryption. Not Math.random(). Genuine, unpredictable randomness.
- Customize length from 4 to 128 characters
- Toggle uppercase, lowercase, numbers, and symbols
- Exclude confusing characters (0/O, 1/l/I)
- Real-time strength meter based on NIST entropy calculations
- 100% client-side — your password never touches a network cable
Related Reading
Once you have a password, learn how to store it securely with proper encoding or use the Hash Generator to understand how passwords are hashed server-side.
All ByteBox tools run 100% client-side. No data is ever uploaded to our servers.