Password Safety Basics: Length, Uniqueness and Password Managers
Most account takeovers are not clever hacks. They happen because a password was weak, was reused, or was exposed in a breach at a different company. A few habits remove most of that risk, and none of them requires memorising anything difficult.
Length beats complexity
Every extra character multiplies the number of guesses an attacker needs. The generator here draws from a set of 76 characters when symbols are included, so adding one character multiplies the possibilities by about 76. Length therefore counts far more than a clever substitution such as an @ for an a.
The Password Generator reports the entropy of the password it generates. Entropy is measured in bits, and each additional bit doubles the work needed to guess the password by brute force.
Entropy by length
The figures below come from the same formula the tool uses: length × log2(76), rounded to a whole bit. The second column shows the same value without symbols, where the character set is 57.
| Length | With symbols | Without symbols |
|---|---|---|
| 8 characters | 50 bits | 47 bits |
| 12 characters | 75 bits | 70 bits |
| 16 characters | 100 bits | 93 bits |
| 20 characters | 125 bits | 117 bits |
An 8-character password is not eight times weaker than a 16-character one. It is weaker by a factor of about 250, because the bits add up rather than the characters.
Never reuse a password
When a company is breached, lists of email addresses and passwords circulate. Attackers then try each pair on email providers, banks, shops and social networks in an automated process. Any account that shares the password falls in the same wave, even though it was never breached itself.
Uniqueness turns one breach into one lost account instead of many. It also limits the damage from a password that was weak but not yet cracked, because the same guess will not work elsewhere.
Use a password manager
Nobody can remember dozens of long random passwords, and trying to do so leads back to reuse. A password manager stores them in an encrypted vault and fills them in when needed. You then remember one long passphrase instead of many passwords.
- Choose a reputable manager and set a long passphrase made of several unrelated words.
- Turn on two-factor authentication for the manager itself, because it now protects everything else.
- Generate a different random password for every account and save it as you go.
- Keep a recovery method, such as a printed recovery code, somewhere physically secure.
The vault becomes a single point of failure, so protect it more carefully than any individual account. A passphrase of five or six random words is easier to type and remember than a short string of symbols.
How the generator works
The tool picks each character with the browser's cryptographic random generator, which is designed for security rather than for visual randomness. It leaves out look-alike characters such as capital I and O, and the digit 0 and 1, so a password can be read from a screen and typed without confusion.
Generation happens on your device. The password is not sent to Numora and is not stored, which also means a page refresh loses it. Save it in the manager before you close the tab.
Two-factor authentication and recovery
A password is one factor. A second factor, such as an authenticator app or a hardware key, means a stolen password alone is not enough. Prefer an app or a key over codes sent by text message, which can be intercepted.
Recovery codes matter as much as the second factor. Store them offline, and check that the recovery email address on each important account is one you still control. An outdated recovery address is a common route back in for an attacker.
What to do after a breach
Act on the specific account first, then check where else the same password was used. Changing the password in the manager updates every device that syncs it, which is one of the practical advantages of using one.
- Change the password on the affected account and sign out other sessions.
- Change the same password anywhere it was reused.
- Turn on two-factor authentication if it was off.
- Watch for phishing messages that mention the breach and ask you to log in through a link.
Habits that cause most failures
- Reusing a strong password. Strength does not survive a breach at the site that stored it.
- Choosing a short password because it has symbols. Length contributes more entropy than a substitution.
- Storing passwords in a note or spreadsheet. Neither is encrypted for this purpose.
- Ignoring the recovery address. It is often the weakest link on an otherwise protected account.
- Trusting a login link in a message. Open the site directly instead of following the link.
If you need random values for a draw or a game rather than for security, the Random Number Generator uses the same secure generator.
Frequently asked questions
How long should a password be?
Aim for at least 16 random characters, or 20 where the site allows it. Each extra character multiplies the possibilities by about 76, so length does more than complexity.
Is it safe to reuse a strong password on two sites?
No. A breach at one site exposes that password to automated attempts on every other account that shares it, however strong the password was.
Where should I store passwords?
In a password manager protected by a long passphrase and two-factor authentication. A note, a spreadsheet or a browser page left open is not a safe substitute.
Does Numora see the generated password?
No. The generator runs in your browser and the password is not sent or stored. Refreshing the page loses it, so save it in your manager first.
- Password Generator – Generate a random password in your browser.
- Random Number Generator – Pick random whole numbers in a range.
More guides
- How to Calculate Percentages: 3 Methods and the Mistakes to Avoid
- Understanding Compound Interest: Why Time Matters More Than Amount
- How Loan Payments Work: Principal, Interest and the Cost of Time
- Browse all guides
This guide is for general information and is not financial, tax, legal or medical advice. See our disclaimer.