How the strength is computed
For a password of length L drawn from a set of N characters, every one of NL strings is equally likely, so the entropy is exactly L × log2(N) bits. The meter above is that number for your settings, not a guess from the output.
“At least one of each kind” changes the count. Strings missing a kind are no longer allowed, so the generator counts what is left with inclusion-exclusion (all strings, minus those missing one kind, plus those missing two, and so on) and draws again whenever a password breaks the rule. Redrawing keeps every allowed password equally likely; patching a character in afterwards would not. The rule costs little for long passwords and more for short ones: for 8 characters from all 94 it removes about 54% of the strings, 1.1 bits (worked through on the methodology page).
Bits by length and character set
| Length | Digits (10) | Lowercase (26) | Letters (52) | Letters + digits (62) | All printable ASCII (94) |
|---|---|---|---|---|---|
| 8 | 26.6 | 37.6 | 45.6 | 47.6 | 52.4 |
| 10 | 33.2 | 47.0 | 57.0 | 59.5 | 65.5 |
| 12 | 39.9 | 56.4 | 68.4 | 71.5 | 78.7 |
| 14 | 46.5 | 65.8 | 79.8 | 83.4 | 91.8 |
| 16 | 53.2 | 75.2 | 91.2 | 95.3 | 104.9 |
| 20 | 66.4 | 94.0 | 114.0 | 119.1 | 131.1 |
| 24 | 79.7 | 112.8 | 136.8 | 142.9 | 157.3 |
The options
- Length matters most. Each extra character adds log2(N) bits: 6.2 bits with the default 75 characters.
- Symbols. The easy set is
!#$%&*+-=?@^_, 13 characters that most sites accept and most keyboards type without hunting. The full set is all 32 ASCII punctuation characters, including quotes, backslash and brackets, which some systems reject. - Avoid look-alikes removes
I l 1 | O 0 o, useful when a password will be read aloud or typed from paper. It costs a little: 20 characters from 69 instead of 75 is 122.2 bits instead of 124.6. See character sets and look-alikes.
NIST's current guidance (SP 800-63B-4) tells services not to impose composition rules at all, and to accept at least 64 characters. Many still do impose them, so the options are here to satisfy them, not because mixing kinds is what makes a random password strong. Length is: see why length beats complexity.