Password Security
How strong passwords actually work, and how to generate them
A password's strength is really just a measure of entropy — how many guesses an attacker would need, on average, to find it. A random string like "kX9#mQ2!vL" and a passphrase like "correct horse battery staple" can carry similar entropy despite looking nothing alike, because entropy depends on the size of the character pool and the length, not on how "complicated" something looks to a human eye. NIST's current password guidance (SP 800-63B) actually de-emphasizes forced complexity rules (one uppercase, one symbol, etc.) in favor of length, because long passphrases are both harder to crack and easier for people to remember — the old "P@ssw0rd1!" style rules often produced weaker, more predictable passwords than a long random phrase.
The practical risk most people underestimate isn't a brute-force attack on one password — modern hashing (when sites do it right) makes that slow. It's reuse: the same password across many sites means one breach anywhere exposes every account that shares it. That's the real argument for generating a fresh, random password per site rather than a memorable-but-reused one.
Keysmith generates both random passwords (with full control over character classes) and memorable passphrases, entirely on-device — no account, no cloud sync. It also clears anything you copy from the clipboard after 30 seconds, since a password sitting in clipboard history is its own small leak.
The app
How it compares to other tools
Frequently asked questions
What actually makes a password strong?
Entropy — the number of possible combinations an attacker has to search through, which depends on password length and the size of the character set used (lowercase only vs. lowercase+uppercase+digits+symbols). A longer password with a smaller character set (like a passphrase of random words) can have more entropy than a short one stuffed with symbols. As a rough guideline, security researchers generally consider passwords under 40 bits of entropy weak and 60+ bits comfortably strong for most personal accounts.
Is a passphrase safer than a random string of characters?
It can be, if the words are chosen randomly (not a quotable phrase or lyric) and there are enough of them — four or more random dictionary words generally clears a strong entropy bar. The advantage of a passphrase is memorability without sacrificing much strength; the advantage of a fully random string is that it's typically shorter for the same entropy. Both are fine choices, and a generator that offers both (rather than forcing one style) lets you pick based on whether you need to type or remember it.
Why do password managers auto-clear the clipboard?
Anything copied to a device clipboard is briefly accessible to other apps on some platforms, and clipboard history features (common on both Mac and iOS/iPadOS) can retain what you copied longer than you'd expect. Auto-clearing after a short window (commonly 30-60 seconds) closes that window without requiring you to remember to do it yourself.
Does reusing a strong password across sites matter if it's hard to guess?
Yes — reuse is a bigger real-world risk than weak entropy for most people. If one site you use gets breached and your password leaks (even hashed, since hashes can sometimes be cracked or the breach exposes plaintext), attackers try that same password against your other accounts automatically ("credential stuffing"). A unique password per site means a single breach can't cascade.