Password Security Tips: Length, Entropy and Password Managers

Password advice has changed. People used to be told to cram capitals, numbers and symbols into short passwords and change them every few months. Current guidance from the US National Institute of Standards and Technology (NIST) and Cybersecurity and Infrastructure Security Agency (CISA) focuses instead on length, a different password for every account, and never reusing one that has leaked.

These password security tips follow that guidance. In short, long and unique beats short and complicated, a password manager makes unique passwords practical, and multi-factor authentication (MFA) adds a second lock in case a password escapes.

What makes a password strong?

A strong password is one an attacker is unlikely to guess, even with plenty of computing power and lists of leaked passwords. Three things matter most:

• Length. Every extra character multiplies the number of possibilities an attacker has to try.
• Unpredictability. Attackers don’t guess letter by letter. They start with common passwords, words, names, dates, keyboard patterns and the usual tricks, such as swapping a letter for a number or adding an exclamation mark at the end. A long password built from those patterns can still fall quickly.
• Uniqueness. A password used on one site can only be lost from one site.

Reuse is the quiet danger. When a website is breached, attackers take the leaked email addresses and passwords and try them automatically on other services, an attack known as credential stuffing. If you used the same password elsewhere, they don’t need to guess anything. Your email password deserves the most care, because email is usually how every other password gets reset.

Length matters more than complexity rules

NIST’s current standard, SP 800-63B-4 (August 2025), is written for the organisations that check passwords, but it shows where the evidence points. It says services:

• must require at least 15 characters when a password is the only thing protecting an account, or at least 8 when it’s one part of multi-factor authentication
• should allow passwords of at least 64 characters
• must not impose other composition rules, such as requiring a mix of character types
• must check new passwords against a list of commonly used, expected or compromised passwords
• must allow password managers and autofill, and should allow pasting

CISA’s advice to individuals points the same way: at least 16 characters, either a random string or a passphrase of 4 to 7 unrelated words.

Why drop the “one of each type” rules? Because people meet them in predictable ways: a capital at the start, a number and a symbol at the end. And even when characters are picked at random, a short password using all four types can allow fewer combinations than a longer one made only of lowercase letters, as the table below shows. Symbols do no harm, but they’re a small extra, not the main defence. And none of these numbers makes a password unbreakable: they’re starting points for one that is also random and unique.

What is password entropy?

Entropy measures how unpredictable a password is. It’s counted in bits, and each extra bit doubles the number of possible passwords an attacker would have to work through: 20 bits is about a million possibilities, 40 bits about a trillion.

Entropy describes the method used to make a password, not the finished string. When a password is picked at random from a known set of characters, the number of possibilities can be counted exactly. The table shows a few random settings, worked out with the same calculation the Biberks Password Generator uses.

“All four types” means uppercase, lowercase, numbers and the full set of 26 symbols, with at least one of each. The figures only apply to passwords generated at random.

The arithmetic doesn’t work for a password you made up. One built from a pet’s name and a year looks as if it came from a large set of characters, but an attacker who tries names and years first will reach it far sooner. So a strength score for a password you typed yourself is only an estimate, and no score can tell you whether that password has already leaked.

Passphrases and random passwords

Random passwords

A password drawn at random, character by character, has no human patterns to exploit, so long random passwords are extremely hard to guess. They’re also hard to remember, which is why they pair so well with a password manager.

Passphrases

A passphrase is several words strung together, and CISA suggests 4 to 7 unrelated words. Passphrases are easier to remember and type, so they suit the few passwords you must know by heart, such as the one that unlocks your password manager or your computer.

A passphrase is only as strong as the way its words were chosen. A song lyric, a famous quote or words that naturally go together are predictable; words picked at random, for example with dice and a numbered word list, are not. Biberks’ current Password Generator generates character-based passwords rather than word-based passphrases.

Why password managers help

A password manager is an app, or a feature of your browser or phone, that creates, stores and fills in your passwords. It solves the biggest problem with good password advice: nobody can remember a different long random password for every account.

• It can generate a random password for each new account, so reuse stops.
• It stores your passwords securely, so you only need to remember one main password.
• It fills them in for you, so a long password is no harder to use than a short one.
• Autofill helps against phishing. As the UK National Cyber Security Centre (NCSC) points out, a manager only fills in a password on the correct website. If it won’t fill one in where it normally does, look closely at the address.

A password manager becomes a single valuable target, so protect it with a strong, unique main password or passphrase and two-step verification, and keep its device updated and locked. The NCSC says saving passwords in your browser is fine on your own devices, but not on shared computers.

Use MFA as another layer

A password is one factor: something you know. Multi-factor authentication, also called two-step verification, asks for something more, such as an app code, a security key or a fingerprint on a trusted device, so a stolen password alone isn’t enough.

CISA recommends turning on MFA especially for email, social media and financial accounts. Not every method is equally strong. A code sent by text message is better than nothing, but texts can be intercepted or redirected, and a convincing fake website can trick you into typing in any one-time code. CISA describes FIDO-based methods, such as security keys and passkeys, as the phishing-resistant option.

The FIDO Alliance describes passkeys as sign-in credentials kept on your phone, computer or security key, which you unlock the same way as the device itself, with a fingerprint, face or PIN. There’s no shared secret for a website to store or for you to type into a fake page. Not every service supports them yet, and a password kept alongside a passkey still needs to be strong.

MFA makes an account much harder to take over, not impossible. Keep recovery options, such as a backup email, phone number and recovery codes, current and safe: they’re another way in.

What about changing passwords regularly?

Changing passwords every 30, 60 or 90 days used to be standard advice. NIST now says services must not require periodic changes, which tend to produce small, predictable tweaks. The same standard says a change must be forced when there’s evidence a password has been compromised. So change a password when there’s a reason:

• the service says it was breached, or a breach alert names your account
• you used the same password somewhere that leaked
• you see sign-ins or activity you don’t recognise
• you shared it, or typed it on a device you don’t trust
• the service asks you to for a specific reason, such as a security incident

Make the new password genuinely new, not a variation of the old one.

Check for breached or compromised passwords

A long, random password is still unsafe once it has appeared in a data breach, because attackers try leaked passwords first. That’s why NIST requires services to check new passwords against lists of compromised ones. You can check too:

• Many password managers and browsers warn you when a saved password appears in a known breach or is reused.
• Breach-notification services can tell you when your email address appears in a published breach.
• Treat a warning as a reason to change that password everywhere you used it.

No breach list is complete, so a clean result doesn’t prove a password is safe. And never type a real password into a website you don’t fully trust just because it offers to check it.

How Biberks’ Password Generator works

The Biberks Password Generator makes random, character-based passwords in your browser. You choose:

• the length, from 4 to 128 characters (16 by default)
• which character types to include: uppercase letters, lowercase letters, numbers and symbols
• the symbol set: Full, with 26 symbols, or Site-safe, with 13 that most sites accept
• whether to avoid look-alike characters, such as a capital I and a lowercase l
• how many passwords to make at once: 1, 5 or 10

Each character is picked with your browser’s Web Crypto API, and every password contains at least one character of each type you chose. The tool shows the strength in bits, calculated from your settings, with labels from Weak (under 45 bits) to Excellent (100 bits or more). That figure applies only to passwords generated there. For an account password, CISA’s 16 characters is a sensible floor.

The passwords are made on your device and aren’t sent to Biberks or stored; only your settings are remembered, in your browser. A copied password may stay on your clipboard until you copy something else. A generated password is only as safe as how you use it: on one account, in a password manager, with MFA where offered. You can also read how Biberks tools handle your data.

A practical password checklist

• Use a different password for each important account, starting with your email.
• Prefer long, unpredictable passwords: random characters, or several random words.
• Use a password manager, and protect it with a strong main password and two-step verification.
• Turn on MFA, or use passkeys, wherever they’re offered.
• Don’t keep using a password that has appeared in a breach.
• Don’t share passwords.
• Don’t paste or type passwords into websites you don’t trust, including “password checkers”.
• Change a password promptly if you suspect it has been exposed.
• Keep recovery email addresses, phone numbers and recovery codes up to date and safe.