How Random Should Your Password Actually Be?

Strength is entropy, not cleverness

A password's real strength is measured in entropy — roughly, how many guesses an attacker with no other information would need to try before finding it. A password that feels clever to you (a pet's name plus a birth year plus an exclamation point) follows a pattern that password-cracking tools are specifically built to try early, because millions of other people follow the same predictable pattern. True randomness has no pattern to exploit — which is exactly why it's so effective, and exactly why it's hard to generate reliably by just 'thinking of something random' yourself.

What actually makes a password crackable

Modern attacks rarely try every possible combination in pure brute force from the start. They typically try, in order: known leaked passwords first, then dictionary words and common substitutions (p@ssw0rd is not clever — it's one of the first substitution patterns any cracking tool tries), then names and dates, and only fall back to brute force once the 'likely' patterns are exhausted. A password generated with true randomness skips straight past all of those faster attack methods, since there's no pattern to match against.

How much randomness is enough?

Length matters more than complexity once you're using genuine randomness. A 16-character password drawn randomly from a large character set (upper and lowercase letters, digits, symbols) has such an enormous number of possible combinations that brute-forcing it is impractical with current technology, even accounting for future hardware improvements over the useful lifetime of that password. Security guidance has broadly shifted toward this length-first approach — Xrandom's Password Generator defaults to 16 characters for exactly this reason, while still letting you dial length up for higher-stakes accounts.

Passwords vs. passphrases

A long passphrase of random unrelated words (like the classic 'correct horse battery staple' example) can carry comparable or greater entropy than a shorter random-character password, while being genuinely easier for a human to type and remember. The key word is random words — a memorable phrase you made up yourself follows the same predictable-pattern problem as a clever password. If you want a passphrase-style approach, Xrandom's Random Word Generator can supply the random building blocks; just use several independent words strung together, not a single one.

Where maximum randomness matters most

Not every password needs the same level of care, but a few deserve extra attention: your password manager's master password (since it protects everything else), any account recovery codes, and any cryptographic key or token used in code or infrastructure. For raw cryptographic material — API keys, salts, session tokens — reach for Xrandom's Raw Random Bytes Generator, which exposes the full random byte range rather than a limited character alphabet.

The practical checklist

• Use a password manager, and let it generate and store unique passwords per site.
• Never reuse a password across sites — a single breach shouldn't be able to unlock your other accounts.
• Favor length (16+ characters) over forced complexity rules when you have the choice.
• Reserve extra-long, maximum-entropy passwords for your password manager's master password and any account recovery codes.