How we worked it out
Updated as you change the numbers.
Method and assumptions
Characters are drawn uniformly with the Web Crypto API. Strength in bits measures how many guesses an attacker would need: each extra bit doubles it. Length matters more than symbols; a password manager can store long passwords for you.
Questions
How long should a password be?
At least 15 characters for important accounts, as NIST guidance suggests; longer random passwords are stronger.
Sources
Method and figures checked on . Every worked answer on this page is covered by an automated test. Found a mistake? Tell us.