A password strength meter that just says "Strong" or shows a green bar isn't telling you much. A specific number — like "78.5 bits of entropy" — actually is, once you know what it means.
Where the number comes from
Entropy here measures how many possible passwords could have been generated given the same rules, expressed as a power of two. Our Password Generator calculates it as length × log2(pool size), where the pool size is how many distinct characters were available to choose from:
- Uppercase letters: 26 characters
- Lowercase letters: 26 characters
- Numbers: 10 characters
- Symbols: 22 characters
Select all four and the pool is 84 characters; a 16-character password from that pool has 16 × log2(84) ≈ 103 bits of entropy. Each added bit doubles the number of possible passwords an attacker would need to try — entropy is measuring search space, not "feel."
Why length matters more than people expect
Because entropy scales the pool-size term logarithmically but the length term linearly, adding characters helps more than adding character types. Going from a 60-character pool (upper+lower+numbers) to an 84-character pool (adding symbols) only adds about 2.4 bits per character. Going from a 12-character password to a 16-character password in the same pool adds 4 characters' worth of entropy outright — typically a much bigger jump. This is the real basis for "longer beats more complex" as security advice; it isn't a rule of thumb, it falls directly out of the math.
What the strength labels mean
The tool's Very Weak / Weak / Reasonable / Strong / Very Strong labels are entropy thresholds: under 28 bits is Very Weak (crackable essentially instantly with modern hardware), 28-35 is Weak, 36-59 is Reasonable, 60-127 is Strong, and 128+ is Very Strong — the point past which brute-forcing it stops being a realistic attack at all, even for well-resourced attackers.
Two details worth knowing
The generator guarantees at least one character from every type you select — checking "include symbols" always produces a symbol, rather than a generator that technically allows symbols but rarely includes one. And it uses PHP's random_int(), a cryptographically secure random number generator, not the ordinary rand() function — the difference matters because ordinary pseudo-random generators can, in principle, have their output predicted, which defeats the point of a random password regardless of how long it is.
Using the tool
Choose a length, pick which character types to include, optionally exclude visually ambiguous characters (like l, 1, I, 0, O — useful if you'll ever need to type the password by hand from a printout), and generate up to 20 at once. Try it here: Password Generator.