Password strength is not about uppercase letters and symbols — it is about entropy. This guide explains what entropy means, how length and character sets interact, and what NIST currently recommends.
Entropy basics
Password entropy (in bits) measures how many guesses an attacker needs in the worst case:
``
entropy = length × log2(charset_size)
`
Examples:
- 12 chars, lowercase only (26): 12 × 4.7 = 56 bits — crackable in hours offline
- 12 chars, full ASCII (94): 12 × 6.55 = 79 bits — 14,000+ years at 1T guesses/sec
- 16 chars, full ASCII (94): 16 × 6.55 = 105 bits — effectively uncrackable
Length matters more than complexity. A 16-character lowercase-only password has more entropy than a 12-character mixed-case+symbols password.
NIST SP 800-63B (2024 guidance)
NIST's current recommendations reversed the "complexity rules" advice of earlier years:
- Minimum 8 characters, allow up to 64+
- Do not enforce complexity rules — they produce predictable patterns (P@ssword1)
- Check passwords against breached lists (Have I Been Pwned API)
- Do not force periodic rotation unless compromised
- Allow paste — do not block password manager input
The focus shifted from "hard for users to remember" to "hard for machines to guess."
Generating passwords in code
Use a CSPRNG (cryptographically secure pseudo-random number generator) — not Math.random() or rand().
Python (recommended):
<code>python
<p>import secrets, string</p>
<p>charset = string.ascii_letters + string.digits + string.punctuation</p>
<p>password = ''.join(secrets.choice(charset) for _ in range(16))</p>
</code>
Node.js:
<code>javascript
<p>const crypto = require('crypto');</p>
<p>const charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*';</p>
<p>const password = Array.from(crypto.randomBytes(16))</p>
<p>.map(b => charset[b % charset.length])</p>
<p>.join('');</p>
</code>
Go:
`go
import "crypto/rand"; import "math/big"
func genPassword(length int, charset string) string {
b := make([]byte, length)
for i := range b {
n, _ := rand.Int(rand.Reader, big.NewInt(int64(len(charset))))
b[i] = charset[n.Int64()]
}
return string(b)
}
`
The critical rule: secrets / crypto.randomBytes / crypto/rand are CSPRNGs. Math.random(), random.random(), and rand.Intn()` are not — do not use them for passwords.
Password hashing in applications
Storing plaintext passwords is never acceptable. Use a password-hashing algorithm designed to be slow:
- Argon2id — current OWASP recommendation, memory-hard
- bcrypt — widely supported, still secure for most use cases (cost factor ≥ 12)
- scrypt — memory-hard, good for new systems
Never use MD5, SHA-1, or SHA-256 for password storage — they are too fast. A modern GPU can test billions of SHA-256 hashes per second against an offline dump.
Quick generation
For development credentials, test accounts, and seed data, the Password Generator on SnappyTools generates cryptographically random passwords with configurable length and character sets. Everything runs in your browser.
Generate secure passwords at snappytools.app/password-generator/ — choose length, charset, and bulk count.
Originally published at https://snappytools.app/password-generator/</a></em></p>