Password Guide

Random password generator — how 4 character sets beat length

4 min readSecurity

Everyone knows longer is stronger. People forget the other half of the equation: variety. A 15-character password drawn from lowercase only has 26¹⁵ guesses. A 15-character password with lowercase, uppercase, digits and symbols has roughly 95¹⁵ — a gap that starts at thousands and balloons into something a GPU farm still cannot climb.

Why rainbow tables still lose

Precomputed hash tables are built for common patterns: dictionary words, leaked password lists, and predictable mutations like "Passw0rd!". A cryptographically random string has no dictionary entry and no mutation rule, so rainbow and lookup attacks have nothing to match. This is why a random 16-character password survives databases that leaked millions of human-chosen ones.

The symbol trap

Websites that force a symbol often push users to the same three. If your set is effectively !@#, you are not adding three characters of entropy — you are adding ~1.6. The fix is a random character pulled from a wide symbol set and placed anywhere. A proper generator picks each position independently, so the symbol could land in the middle, not just the end.

What 4 sets give you

  1. Lowercase — the volume set, 26 characters.
  2. Uppercase — doubles the alphabet when mixed.
  3. Digits — 10 more symbols that crackers can't assume away.
  4. Symbols — 20+ more only present when you ask for them.

Each set you enable is a multiplier, not an add-on. Enable all four on the password mode and the generator forces at least one from each set before filling the rest, guaranteeing you never ship a password that's all lowercase.

"Length buys depth; character sets buy width. Cryptanalysis rewards a password that is both deep and wide."

Strength scoring that checks itself

A good generator grades your password and shows a score from Very weak to Excellent. That is not marketing — it is a sanity check that your random output actually landed in a strong zone before you store it in a manager. If a roll comes back "Weak", re-roll; randomness occasionally clusters and a meter catches it.

Generate a fresh, properly-scored key on the randzen password generator and your accounts stop depending on your memory of what a "strong password" feels like.