We Generated 10,000 Passwords: What Actually Makes One Strong

We generated 10,000 passwords and measured what actually makes one strong: length beats complexity by a wide margin. An 8-character lowercase password falls in a median 10 seconds against a fast offline attack, while a 16-character password with all four character classes takes a median 58.9 trillion years. Generate one that strong instantly with our free password generator, and read on for the full data, the charts, and the one coverage gap random generation cannot fix on its own.

Try it now: Password Generator →

How the study was run

We generated 10,000 passwords locally with Python's secrets module, which draws each character uniformly at random from the chosen set, the same model our free password generator uses in your browser. No real user passwords were involved, nothing was uploaded, and no password from the sample is published here. The 10,000 split evenly into five presets of 2,000 each: 8 characters of lowercase letters only; 12 characters of lowercase plus digits; 12 characters of upper, lower, and digits; 16 characters of all four classes; and 20 characters of all four classes. Crack times assume an offline attack against a leaked hash at 10 billion guesses per second, a strong attacker with GPU hardware, and the median case, meaning half of passwords at that entropy fall faster and half slower. Online login forms with lockouts and throttling are far slower to attack, so these numbers describe the worst case: a stolen password database, not a login page.

Try it now: Password Generator →

The length cliff: four extra characters change everything

Entropy, the count of possible combinations expressed in bits, is what decides crack time, and length multiplies it faster than any other choice. An 8-character lowercase password carries just 37.6 bits of entropy, and at 10 billion guesses per second its median crack time is 10 seconds. Every password in that preset falls in under a day. Add four characters and one more character class, and the picture flips: a 12-character lowercase-plus-digits password carries 62.0 bits and survives a median 8 years. A 12-character password with upper, lower, and digits reaches 71.5 bits and a median 5,112 years. The jump from 8 to 12 characters is worth roughly 500 years of attacker time, because each added character multiplies the search space by the size of the alphabet. Complexity helps, but it helps slowly: switching from lowercase-only to all four classes at the same length adds far less than adding four characters does. If you remember one rule from this study, it is that length is the lever, and everything else is fine tuning.

Sixteen characters is where cracking stops being practical

At 16 characters with all four classes, entropy reaches 104.9 bits and the median crack time is about 58.9 trillion years, roughly four thousand times the age of the universe. At 20 characters it is 4.6 sextillion years, a number with no practical meaning beyond uncrackable. These are not promises that a password can never be stolen: phishing, reuse, and malware bypass guessing entirely, and a password stored in plain text by a careless site falls instantly no matter how long it is. What the numbers do say is that guessing stops being a viable attack path at 16 random characters, which is why security guidance keeps converging on that length. The practical upshot is simple: a 16-character random password is already past the point where more length buys real safety, and the remaining risks are about how you store and reuse it, not how many characters it has.

The coverage gap: random does not mean complete

One surprise in the data is that a random password is not guaranteed to contain every character class you asked for. Among the 16-character all-classes passwords, 18.0 percent were missing at least one class, usually symbols or uppercase letters, and among the 20-character ones, 11.0 percent still missed a class. Random choice can simply skip a class, and the longer the password the less likely that becomes, but it never reaches zero. Across all 10,000 passwords, only 34.2 percent satisfied a strict policy of 12 or more characters with all four classes present, mostly because the short and narrow presets cannot satisfy it by construction. The lesson for generator design is to force one character from each class first and fill the rest randomly, which is exactly what a good generator should do rather than trusting chance. If your generator lets you tick character classes, tick all four and set the length to 16 or more, then check the result actually contains each class before you use it.

Repeated characters and sequences are mostly noise

Two patterns people worry about turned out to be non-issues for random passwords. Across the sample, 77.3 percent of passwords contained at least one repeated character, which sounds alarming until you remember that random draws repeat: with 94 possible characters and 16 positions, repeats are expected, and they cost almost nothing in entropy. Only 1.1 percent contained a three-character sequence run such as abc or 123, a small share that shrinks further at longer lengths. Neither pattern makes a random password weak, because the attacker still faces the full search space. The patterns that do break passwords are human ones, choosing words, names, and dates, and those never appear in a uniform random sample. So if your generated password contains a doubled letter, keep it. If it contains a short run like 47b, keep that too. Regenerate only when a password is short, narrow, or missing a class you wanted.

What to do with this

Three rules cover nearly everything this study found. First, use at least 16 characters for anything important, generated randomly, not composed from words you can remember. Second, use all four character classes, and verify the result actually contains each one. Third, never reuse a password across sites, because reuse turns one breach into all of them, and store the results in a password manager so length stops being a memory problem. Our free password generator runs entirely in your browser, so generated passwords never leave your device, and you can set length and character classes to match the 16-character all-classes preset this study found uncrackable in practice. If you are changing passwords today, start with email, banking, and your password manager itself, since those three unlock everything else.

Limitations

This study measures randomly generated passwords only, and human-chosen passwords behave far worse: dictionaries, names, keyboard walks, and reused phrases cut effective entropy far below the length-times-alphabet formula, which is why real breach data is full of short, guessable passwords. Crack times assume a fast offline attack on a weakly hashed database; a site using a slow modern hash or rate-limited logins would take far longer, while a site storing plain text would take no time at all. The sample is 10,000 passwords, large enough for the percentages quoted here to be stable within about a percentage point, but it is a model of generator output, not a survey of what people actually use. Treat the crack times as order-of-magnitude comparisons between presets, not as guarantees about any single password.