Entropy, not complexity rules
Password strength is measured in bits of entropy: length multiplied by the log base two of the character set size. Each additional character multiplies the search space, which is why length beats symbol substitution decisively.
A twenty-character lowercase passphrase carries about 94 bits — far stronger than an eight-character password using every symbol on the keyboard, which manages only about 52.
This assumes a genuinely random password
The calculation treats every character as independently random. Real passwords rarely are. "P@ssw0rd123" has the character-set profile of a strong password and the actual strength of a trivially guessable one, because attackers try dictionary transformations first.
Anything built from a word, a name, a date or a keyboard pattern falls to a targeted attack in a fraction of the time shown here. The figures are an upper bound, not a promise.
What to do instead
Use a password manager to generate long random strings you never have to remember, and enable two-factor authentication wherever it is offered — it defeats credential stuffing even when a password does leak.
For passwords you must memorise, a passphrase of five or six random words is both stronger and easier to recall than a short scrambled string.
Frequently asked questions
Is my password sent anywhere? +
No. This page never asks for your actual password — only its length and character set — and every calculation on this site runs entirely in your browser.
How many bits is enough? +
Roughly 80 bits resists offline attack today. Aim for 100 or more on anything valuable, which a password manager gives you for free.