Random Passwords vs Passphrases: Entropy Maths and Real Crack Times

How to count entropy (the honest formula)

Entropy in bits = length x log2(alphabet size). A lowercase a-z alphabet is 26, so each character carries about 4.7 bits; adding capitals, digits and symbols lifts the pool toward 95 characters, about 6.5 bits each.

The uncomfortable read: a memorable four-word passphrase is only about as strong as a 9-character random password. Randomness per character is what pays, so passphrases win by being long, not by being clever - add words, do not add punctuation theatre.

Crack time is an offline threat model, not a stopwatch

A brute-force 4-digit PIN on a website with rate-limiting is slow to attack; a leaked password database is different. When hashes leak, an attacker tries billions of guesses per second offline against a fast hash, so the ceiling that matters is 2 to the (entropy/2) average guesses.

Rough, honest scale: about 40 bits falls in seconds on modern hardware; about 60 bits takes a while but is feasible for a determined attacker; 80+ bits is out of reach; and 100+ bits is effectively unbreakable by brute force. This is why the 16-character full-alphabet example above (about 105 bits) is the one that survives a database breach.

Real attackers do not brute force uniformly - they use wordlists, rules and leaked passwords first - which is exactly why a random string with no dictionary word, from the generator, beats a human-invented one of the same length.

Where hashing fits (and why MD5 is not a password tool)

Storage strength depends on the hash, not just the password. Fast hashes are the problem: the MD5 generator and even raw SHA-256 are built for speed and data checksums, so they make offline guessing cheaper for an attacker. Password stores should use a deliberately slow, salted function (bcrypt, scrypt, Argon2) instead.

So use SHA-256 to check a file's integrity or fingerprint a value, and leave password storage design to a proper hashing function. The generators here are for making good secrets and computing checksums - they are not an advice to hash passwords with MD5.

The manager + 2FA conclusion

Because the real risk is reuse across sites, the highest-value habit is not a single heroic password - it is a unique, long, random password per account, which is only practical with a password manager that stores them so you never reuse or write them down. Generate each one with the generator and let the manager remember it.

Add two-factor authentication wherever offered, because it stops the common failure where one breached site leaks a reused password. For machine identifiers and non-human keys that must be unique, the UUID generator produces values with no reuse risk. A strong password plus 2FA beats a stronger password alone.