Text & everyday tools · Password Generator
Do capitals, digits and separators make a passphrase stronger?
· How it works
passwords passphrases composition-rules
Works out how many bits a capital letter, a digit or a separator actually adds to a passphrase, why the honest answer is 'a little', and how to satisfy composition rules without weakening memorability.
The site that rejects a 70-bit passphrase — composition rules meet a password that is already strong
A destination can reject a long generated phrase because it requires a capital, digit or symbol. That rejection proves a compatibility mismatch, not a complete security assessment. ToolAcre exposes case and delimiter controls for passphrases and a separate character-password mode with four selectable classes. The code does not label one combination safe for every policy or threat model.
The workbook’s example assigns a bit count before naming the exact random process. This article reverses that order. First identify which choices are fixed and which are random; then count only the latter. A field rule can be satisfied predictably, but predictable formatting should not be credited as a fresh independent choice.
Composition rules can reject a generated phrase without proving it weak
Capitalizing every first letter, uppercasing every word or alternating upper and lower case follows a deterministic rule. Given the selected words and rule, there is one result. The option table therefore assigns zero additional bits to those modes, and tests assert that every fixed case transformation contributes nothing beyond the word draws.
This does not mean uppercase characters are forbidden or useless. They may satisfy a destination or make a format visually distinct. The correction is accounting: formatting convenience and policy compatibility are different from random selection. Do not claim extra uncertainty merely because the output contains more character categories.
One random tweak adds a few bits — a capital on a randomly chosen word, a digit at a random position, and how to count them
Random case gives each word an independent upper-or-lower choice, which the implementation counts as one bit per word. Random delimiter mode chooses one of five committed punctuation characters independently for every gap. Those are derivable figures because the option sets and draw locations are visible in source.
A random digit at a random position is not a feature of ToolAcre’s passphrase mode, so this article does not invent its contribution. If digits are required, character-password mode includes the verified digit class and guarantees at least one character from every selected class before a secure shuffle.
Random case and random separators add only the choices the code actually makes
Space, hyphen, underscore, full stop, colon, pipe and no separator are fixed menu options. Choosing one makes every gap predictable from the setting. Random mode instead selects separately from `-_.:|`. The fixed separator may improve typing or fit a field rule, but it is not another random draw.
The empty separator runs words together, which can change readability without changing word selection. A destination may forbid spaces or punctuation, and only that destination’s documented rules can settle compatibility. Test the field rather than assuming every login form treats separators the same way.
Satisfying the rules honestly — add the required characters in a way you can remember, and add a word if you need real strength
When a policy demands several character classes, use the character generator rather than hand-editing a passphrase and then quoting the old estimate. It can select lowercase, uppercase, digits and symbols, requires a length large enough to include every chosen class, fills remaining positions from their union and securely shuffles the complete result.
If a passphrase is preferred for typing, choose a supported case or delimiter accepted by the field. Do not append personal dates, reuse the phrase elsewhere or describe the formatting as universal protection. Policy compliance is one constraint; fresh random generation and separate account use remain distinct requirements.
Satisfying a field rule without claiming universal safety
With an eligible word pool of N and six words, fixed lowercase plus fixed spaces contributes 6 × log₂(N) from words. Random case adds six independent binary choices. Random delimiters add five choices for each of five gaps. A seventh fixed-case word instead adds another log₂(N). Each term comes from a source-visible operation.
This example compares mechanics without publishing a live phrase or choosing a universal target. If length filtering changes N, recalculate with the actual pool. If the destination disallows a selected delimiter, remove that option and its term. The arithmetic follows settings; it does not override the field’s contract.
Worked example: compare fixed case, random case and an extra word arithmetically
Some services impose small maximum lengths or character restrictions that make a multiword passphrase impractical. ToolAcre cannot discover those rules from another site. Its own bounds are three to sixteen words and eight to 128 random characters, but a destination may accept less or reject a supported symbol.
Where the phrase does not fit, use a fresh random character password built from the accepted classes and as much supported length as the service permits. That is a compatibility response, not a claim that every constrained system becomes safe. The service’s authentication and storage still need separate evaluation.
The takeaway — words are the strength; use the Password Generator for the words and treat the symbols as paperwork
Words remain the primary random draws in passphrase mode. Fixed capitals and separators are formatting; random case and random delimiters contribute only their explicit choices. Character mode exists for sites that require class composition and guarantees each selected class appears before shuffling.
Configure the generator from the destination’s verified requirements, then leave the generated result unchanged and unique. Do not retrofit a personal pattern, transmit it as an example or reuse it. A composition rule can shape output, but it does not replace a threat model or turn one credential into a universal answer.