What makes a password strong
What it costs to crack a password by brute force is the number of candidates to try, and that number is the alphabet size raised to the length. It is measured in bits of entropy: the base-2 logarithm of that number, which is how many times an attempt has to be doubled to cover every possibility. Sixteen characters from an alphabet of 77 are about a hundred bits; each added character brings 6.3 more, and each bit doubles the work.
That is where the surprising rule comes from: length beats symbols. Going from lowercase alone to lowercase with symbols raises the alphabet from 26 to 41 and each character from 4.7 to 5.4 bits; adding three more lowercase letters adds 14 bits. A long password of plain words is stronger than a short one full of at-signs, and you can remember it.
Where the randomness comes from
The randomness on this page is the browser’s cryptographic generator, not
Math.random, which is predictable and no good for this. And there is a detail
almost every home-made generator gets wrong: taking the remainder of the random number
divided by the alphabet size favours the first characters, because the generator’s range is
not a multiple of 77. The bias is small — a fraction of one per cent — and it is real; it is
avoided by discarding draws that land in the leftover part and drawing again. At least one
character from each chosen set is also guaranteed, and the result is then shuffled so they
do not always sit at the start.
What to do with it
A hundred-bit password is not memorised, and it does not need to be: it goes into a password manager, which is the only sensible way to have a different one on every site. What must not happen is reuse: most accounts fall not to brute force but because the same password turned up in another service’s breach. With a different one per site, a breach stays on that site.
Worth knowing
The cracking time the page gives assumes a billion guesses a second, which is what a graphics card manages against a fast, unsalted hash. Against an online service that locks after a few attempts the real number is millions of times smaller, and even a six-digit PIN holds. And against a deliberately slow function, like those password managers use, each guess costs far more. Entropy is the honest measure because it depends on none of that: only on the password.
Nothing generated here leaves the browser or is stored. Reload, and it is gone.