What makes a generated password or passphrase strong?

A password doesn't have to look complicated to be hard to guess. What matters is choosing every character or word at random—and choosing enough of them.

FluffyBench · 5 min read · Measured October 15, 2026 against the secure random generator checks

Why random choices make passwords hard to guess

Picture a combination lock: each password character is a dial, and each passphrase word is a dial too. A random generator turns every dial separately, giving each available option an equal chance.

Random dials versus familiar patterns

Random picks don't favor familiar patterns; people often do. How we reviewed

That's the difference between an unpredictable secret and one that looks complicated. People often reach for names, dates, familiar phrases or keyboard patterns. Guessers can try those habits first, including familiar substitutions and an added symbol at the end.

A phrase you invent has the same problem: words that sound natural together aren't independent picks. FluffyBench's Secure random generator chooses characters or words with the browser's cryptographic random source. It doesn't choose a sentence and dress it up. That makes it possible to count the choices that went into the result.

How password length and word count add strength

Here are real outputs from FluffyBench's starting settings: a 20-character password drawn from 85 possible characters, and 6 words drawn from EFF's list of 7,776. Each box is one random pick.

The recorded password !p95&f,0QkT=w!jvw#A? appears as individually boxed characters in two rows. The recorded passphrase humming-joyride-paternal-dawn-gazing-ludicrous appears as six boxed words. — Published examples, including the screenshots on this page, aren't credentials to use.

Every existing password can end in any of 85 extra characters with all character groups selected. Every existing passphrase can take any of 7,776 extra words: adding a random pick multiplies the possibilities.

A completed password branches to a, B, 7 and more, representing 85 possible next characters. A completed passphrase branches to humming, joyride and more, representing 7,776 possible next words. — Each branch is a different ending for the same starting secret.

Bits are a compact way to count possible results: each extra bit doubles the set. FluffyBench's starting settings give these calculated selection spaces.

20 characters · all four groups: 128.2 bits
6 words · EFF long list: 77.5 bits

Bar lengths compare bits, not guessing difficulty; each extra bit doubles the possibilities.

The character password gives a blind guesser far more possibilities at these settings. The word phrase can grow too: more independently chosen words mean more possibilities. A separator such as a hyphen makes words easier to read, but it isn't another random pick.

Should you use a password or a passphrase?

Choose by how you'll use the secret. A password manager can handle a jumble of characters; randomly chosen words are easier to remember when you need to type a secret yourself.

A choice node branches into two paths. Password manager fills the login points to generated password. You need to remember the secret points to randomly generated passphrase. — Both paths start with random selection.

A longer-looking phrase isn't automatically stronger than a shorter character password. What matters is the number of independent picks and the options each pick had. You don't need to invent something clever to get that benefit.

Give each account its own secret. Random selection doesn't prevent reuse or phishing, so pay attention to where you enter it and use a phishing-resistant sign-in option when the site offers one.

Doing it in FluffyBench

FluffyBench's Secure random generator makes passwords and passphrases locally in your browser. Check the receiving website's length and character rules before choosing your settings; a long phrase still has to fit its password field.

For a password you can save in a password manager, use Password. Characters adds the checked groups to one pool; it doesn't require every group to appear, so check the result against any required mix.

Step 1. Choose Password and set the options before generating.
1. Choose Password under Type.
2. Length sets the character count; use 20 here.
3. Tick the character groups the website allows.
Step 2. Press Generate to make a fresh password.
1. Generate uses the settings you've chosen.
Step 3. Check the generated password against the website's character rules.
1. Check the generated characters against any required mix.
Step 4. Check the count underneath the password.
1. Check the character count beside the bit estimate.
Step 5. Press Copy, then paste your new password into your password manager.
1. Copy puts the result on your clipboard.

For words you need to remember, use Passphrase. Words changes the number of random picks; Between words changes how they're joined.

Step 1. Choose Passphrase and set the word count and separator.
1. Choose Passphrase under Type.
2. Set Words to 6 here.
3. Choose Hyphen under Between words.
Step 2. Press Generate to pick fresh words.
1. Generate draws words from the EFF long list.
Step 3. Your passphrase appears in Result; the Copy control works as shown in the password walkthrough.
1. The generated words are joined with hyphens.

FluffyBench doesn't save your result or check it against known breaches.

Need FluffyBench's Secure random generator to make a fresh password or passphrase?

Secure random generator

How we measured

Date: October 15, 2026. Runtime: The sample outputs were recorded in Chromium 153.0.8010.12; source checks used Node.js v24.16.0 and Node Web Crypto and built-in crypto APIs and did not involve browser interaction. Device: Windows 11 Pro · AMD Ryzen 9 5950X (16 processing cores).

The default password uses 20 characters from 85 possible characters; the default passphrase uses 6 words from a list of 7,776 words. Their selection-space estimates are 128.2 bits and 77.5 bits.

The test set covers a default password, a default passphrase, configured boundaries, and output selection behavior. The lock, branching and decision diagrams are illustrations; the boxed outputs come from the recorded examples.

Selection space is shown in bits. Character and word counts use the generator's displayed units.

The calculation is picks × log2(options per pick): 20 × log2(85) = 128.2 bits; 6 × log2(7,776) = 77.5 bits. Values are rounded to one decimal place.

These estimates assume independent uniform choices. The implementation uses Web Crypto and rejects values in the incomplete tail of the random-number range to avoid favoring particular options. The passphrase separator adds no random choice.

Selection-space estimates do not measure human-created secrets, service-side password storage, guessing limits, reuse, malware, or phishing.

NIST's guidance for centrally verified passwords requires at least 15 characters for single-factor use, recommends accepting at least 64 characters, and says not to require a mix of character types. Its appendix discusses predictable human responses to composition rules.