What Makes a Password Strong
A strong password is one an attacker cannot guess in any reasonable time. That depends mostly on how many possible passwords yours could have been, which comes down to length and true randomness, not clever substitutions.
Entropy: counting the guesses
Entropy measures a password's unpredictability in bits: length × log2(size of the character set). Each extra bit doubles the guesses needed. This only applies to randomly generated passwords. A password you make up yourself has far less entropy than its length suggests, because people pick predictable patterns.
| Password type | Possible characters | Entropy |
|---|---|---|
| 4-digit PIN | 10 | 13.3 bits |
| 8 random lowercase letters | 26 | 37.6 bits |
| 8 random characters, all keyboard symbols | 95 | 52.6 bits |
| 4 random words from a 7,776-word list | 7,776 words | 51.7 bits |
| 5 random words from a 7,776-word list | 7,776 words | 64.6 bits |
| 12 random characters, all keyboard symbols | 95 | 78.8 bits |
| 16 random lowercase letters | 26 | 75.2 bits |
Length beats complexity
Look at the table again: 16 lowercase letters (75.2 bits) beat 8 characters drawn from every symbol on the keyboard (52.6 bits) by more than 22 bits. That is over 4 million times as many guesses. Adding length grows the number of combinations far faster than adding character types.
This is why current NIST guidance favours long passwords and passphrases and discourages forced rules like "one capital, one number, one symbol", which tend to produce Password1! style results.
Real examples
- Summer2024!: looks complex, but a season, a year and a symbol is one of the first patterns cracking tools try.
- P@ssw0rd: letter-to-symbol swaps are built into every cracking dictionary, so this is effectively the word password.
- correct-horse-battery-staple style passphrases: strong only if the words were picked at random, not a song lyric or quote.
- A 16-character random password from a generator: about 98 bits with mixed sets. Not practical to brute force with current hardware.
Habits that matter more than any single password
- Use a different password for every site. Most account takeovers reuse passwords leaked from another site.
- Store them in a password manager so length costs you nothing.
- Turn on two-factor authentication for email and banking first, since email resets everything else.
- Change a password when a site reports a breach, not on a fixed schedule.