Question 1

What makes a password strong?

Accepted Answer

A strong password has high entropy — it is long and uses a large character set. A 16-character password using uppercase, lowercase, digits, and symbols has ~105 bits of entropy, making brute-force attacks computationally infeasible. Key factors: length (most important), character variety (uppercase + lowercase + digits + symbols), no dictionary words or patterns, and uniqueness (never reused across sites). NIST guidelines recommend at least 12 characters; 16+ is safer.

Question 2

What is the difference between password length and entropy?

Accepted Answer

Entropy (measured in bits) quantifies how unpredictable a password is. Formula: entropy = length × log2(character_set_size). A 12-character lowercase password (26 chars) has 12 × 4.7 ≈ 56 bits. A 12-character password with 95 printable ASCII chars has 12 × 6.57 ≈ 79 bits. Each additional bit doubles the search space. Adding one character is more effective than adding character types: a 16-character lowercase password (75 bits) is stronger than a 10-character mixed-case+symbol password (65 bits).

Question 3

Should I use a passphrase or a random character password?

Accepted Answer

Both can be equally secure at equivalent entropy. A 4–5 word diceware passphrase (e.g., 'correct horse battery staple') has ~51–64 bits of entropy and is much easier to memorize than a random character string. Random character passwords (e.g., 'Kx9#mLq2') are harder to remember but shorter for equivalent entropy. For master passwords (password managers, encryption keys) — use a long passphrase. For account passwords managed in a password manager — use random characters.

Question 4

Is it safe to generate passwords in a browser?

Accepted Answer

Yes — this tool generates passwords using the browser's Web Crypto API (crypto.getRandomValues), which uses the OS cryptographically secure pseudorandom number generator (CSPRNG). Passwords are generated entirely in your browser and never transmitted anywhere. You can verify this by turning off your network connection and generating passwords — they will still work. For critical use cases, you can also use a CLI: openssl rand -base64 32 or python3 -c 'import secrets; print(secrets.token_urlsafe(32))'.

các công cụ miễn phí dành cho lập trình viên web

Trình tạo mật khẩu

Cấu hình

Tạo

Mật khẩu

Cách Trình tạo Mật khẩu Hoạt động

Công cụ làm gì

Các trường hợp sử dụng phổ biến cho lập trình viên

Định dạng dữ liệu, kiểu hoặc biến thể

Các lỗi thường gặp và trường hợp biên

Khi nào nên dùng công cụ này thay vì viết mã