Password strength
Password strength is an estimate of how hard it would be for someone else to recover a generated password by trying all possible combinations. RandPass rates that difficulty as entropy: how many bits of uncertainty an attacker faces when the generation settings are known. The rating describes the current options, not a particular output string. Two passwords produced with the same settings have the same strength.
Length is the main lever. A longer password from a smaller pool is often stronger than a short one from a larger pool. The rating is meaningful because RandPass draws each character or word at random. A phrase a person invents, even if it looks similar, is much easier to guess.
The calculation assumes the attacker knows the method: which tab is used, the character pool or word list, the length or word count, and any format or extra options. That is the conservative figure. If those details are not known, guessing takes longer, but the extra margin is not something to rely on.
Strength levels
The indicator maps entropy to a labeled level:
| Level | Entropy |
|---|---|
| Very weak | 0 bits and above |
| Weak | 28 bits and above |
| Fair | 36 bits and above |
| Strong | 60 bits and above |
| Very strong | 128 bits and above |
Each password is shown as the highest level whose threshold it meets.
The rating accounts for the active generation options: the size of the character pool or word list, how many random characters or words are drawn, and extras such as a random digit, symbol, or per-word case change. Fixed characters in a custom format, and a chosen word delimiter, do not add entropy.
It does not account for whether a string appears in a known breach list, how the destination system stores passwords, online guess limits, or attacks that bypass guessing (phishing, reuse, malware).
Character-based passwords
On the Characters tab, each position is drawn from the enabled character groups (and any custom characters). More groups make a larger pool. More length multiplies that advantage.
| Settings | Length | Entropy | Level |
|---|---|---|---|
| Lower letters only | 8 | 38 bits | Fair |
| Lower, upper, and digits | 8 | 48 bits | Fair |
| Lower, upper, and digits | 12 | 71 bits | Strong |
| Lower, upper, digits, and symbols | 12 | 79 bits | Strong |
A 12-character password from lower letters, upper letters, and digits already reaches Strong.
No similar characters drops lookalikes such as 1, I, and O. That slightly shrinks the pool. Enable it when a password may be copied by hand.
Use custom format only arranges the password after it has been generated. Literals such as hyphens and braces add no strength, and if the pattern consumes fewer characters than Password length (for example {4-2-4} with length 12) the rating still follows the full generated password.
Word-based passwords
On the Words tab, strength comes from how many distinct lists entries could have been chosen, and how many words are drawn. The words do not need to look complex.
With a 7,776-word list (Diceware, EFF, and several of the other bundled lists):
| Words | Entropy | Level |
|---|---|---|
| 4 | 52 bits | Fair |
| 5 | 65 bits | Strong |
| 6 | 78 bits | Strong |
| 10 | 129 bits | Very strong |
Five or six words reach Strong and are a practical default for a passphrase you intend to remember. Use more words when the account is high value or the secret must last a long time.
Smaller lists (such as the EFF Easy lists) need more words to reach the same level. Larger lists need fewer. See word lists for sizes.`
Word case options that apply one rule to every word (Original, Lower case, Upper case, Capitalize words) do not change the rating. Random case per word does, by making each word’s case an extra random choice.
Add random digit and symbol is for sites that still require a digit and a symbol. It adds a little entropy. Another word is the more effective way to raise the level. The word delimiter is a fixed separator and does not add strength.
Random generation
The rating assumes each draw is unpredictable. By default RandPass uses a cryptographically secure random generator provided by the operating system (BCrypt on Windows, urandom on Linux).
Use non-cryptographic random generator in Settings switches to a faster deterministic generator. Passwords produced with that option enabled are not suitable for security-sensitive use.
Using the rating
Aim for Strong for ordinary accounts. Use Very strong for a password-manager master password or another long-lived secret.
The indicator does not replace a unique password per account, a password manager for secrets you do not need to type from memory, or multi-factor authentication where the service offers it.