Strong Passwords and UUIDs

Length and Randomness

A password is strong when an attacker would need too many guesses to find it. Two things matter most: how long it is and how it was chosen. Each extra character multiplies the number of possibilities, so length usually helps more than adding one more symbol type.

The way a password is chosen matters just as much. People tend to pick words, names, dates and predictable substitutions such as "P@ssw0rd", and attackers try those patterns first. A password generated by a secure random source avoids these patterns. The LeedyBox generator uses the browser's Web Crypto random number generator rather than Math.random(), which is not designed for security.

This guide gives general information, not professional security advice. Follow the requirements of your organisation or the service you are signing up for.

What Entropy Bits Mean

Entropy, measured in bits, estimates how many guesses a random password would take. For a password of length L drawn uniformly from N possible characters, entropy is L × log₂(N). Each additional bit doubles the search space.

The estimate has limits. It is only meaningful when every character was picked at random. A password you invented, such as "Summer2026!", may look like it has many bits by this formula but is far easier to guess. Entropy also says nothing about how a service stores passwords, whether the password was reused, or whether it was captured by phishing.

Password Managers and Unique Passwords

Random passwords are hard to remember, which is where a password manager helps: it generates, stores and fills a different password for each site. Using a unique password everywhere matters because data breaches happen, and a reused password lets an attacker try the same login on other services. For the few passwords you need to remember, such as the manager's own master password, a long passphrase of several randomly chosen words is a common approach.

Two-Factor Authentication

Even a strong password can be stolen through phishing or malware. Two-factor authentication (2FA) adds a second check, such as an authenticator app code, a hardware security key or a passkey. Turning it on for email, banking and other important accounts reduces the damage a stolen password can do. Keep the recovery codes somewhere safe.

UUID v4 vs UUID v7

A UUID (universally unique identifier) is a 128-bit value written as 36 characters, such as 550e8400-e29b-41d4-a716-446655440000. The digit after the second hyphen shows the version.

• UUID v4 is mostly random (122 of its 128 bits). It reveals nothing about when or where it was created, and the chance of two colliding is negligible for practical purposes.
• UUID v7, defined in RFC 9562, starts with a Unix timestamp in milliseconds followed by random bits. Values created later sort after earlier ones, which can make database indexes more efficient than with v4. The trade-off is that anyone who sees a v7 UUID can read roughly when it was created.

The LeedyBox tool can generate both versions, and its UUID inspector lets you examine a UUID you paste in.

UUIDs Are Identifiers, Not Secrets

A UUID is designed to be unique, not secret. Many UUIDs end up in URLs, logs and API responses, and a v7 UUID carries its creation time. Do not use a UUID as a password, API key or password reset token on its own; use a dedicated random token from a secure generator, combined with proper access checks.

Frequently Asked Questions