What Actually Makes a Password Strong

Password strength is one equation: length times the log of the character pool. Almost every rule people were taught optimises the wrong half of it.

Strength is measured in bits, not symbols

A password’s strength is the size of the space an attacker has to search. That space is set by two things and nothing else: how many characters are in the pool, and how many characters you drew from it.

The critical detail: adding one character to the length multiplies the search space, while adding a whole character class only nudges the per-character value. Going from 8 characters to 12 in the same pool multiplies the work by roughly 6.6 million. Adding symbols to an 8-character password multiplies it by about 40. Length wins, and it is not close.

How long a randomly generated password holds up

Times below assume an offline attack on a poorly protected password database at one trillion guesses per second, and the average case of searching half the space.

An 8-character password is not a password. It has been within reach of consumer hardware for years, whatever mixture of symbols it contains.

That trillion-per-second figure is the worst case, and it matters that it is a property of the service, not of you. A site storing passwords with a slow, memory-hard function such as bcrypt, scrypt or Argon2 caps an attacker nearer ten thousand guesses per second — at which point even 8 random characters would take millennia. You have no way of knowing which kind of site you are dealing with, so assume the bad one.

Passphrases reach the same place, more memorably

Pick words at random from a known list rather than characters from an alphabet. With the standard 7,776-word list, each word contributes 12.9 bits.

Six random words is genuinely strong and considerably easier to retype on a phone or a TV remote than sixteen random symbols. The word "random" is load-bearing: words you chose because they mean something to you carry a fraction of that entropy.

The maths only applies to random

Every figure above assumes the password was generated by something that does not think. Human-chosen passwords are not drawn uniformly from the character space, and cracking tools are built around exactly that.

• Substitutions are expected. Replacing a with @, o with 0, s with $ adds nothing. Those rules are the first thing a cracking ruleset applies.
• Structure is predictable. Capital first, digits and a symbol at the end is the shape of a large share of real passwords, and attacks are ordered accordingly.
• Reuse defeats everything. A 20-character password used on two sites is only as strong as the weaker site’s security. This is the single most common route to a compromised account.
• Personal data is public. Names, birthdays, pets and sports teams are in the dictionaries.

The password generator runs entirely in the browser and can produce either character strings or word-based passphrases. For raw random values in any range, the random number generator does the same job.

What the current guidance says

NIST’s digital identity guidelines were substantially rewritten and now contradict most of the password rules people were trained on. In summary, verifiers should:

• Require a minimum of 8 characters and should require at least 15.
• Permit at least 64 characters, and accept spaces and Unicode.
• Not impose composition rules such as mandatory mixes of character types.
• Not force periodic changes, unless there is evidence of compromise.
• Not use password hints or security questions.
• Check new passwords against lists of known-breached values.
• Allow pasting, so password managers work properly.

The reasoning behind dropping forced rotation is behavioural: made to change every 90 days, people increment a digit, and the new password is trivially derivable from the old one. Complexity rules failed for the same reason — they pushed everyone toward the same small set of predictable patterns.

What actually protects an account

Ranked by how much they matter:

• A different password everywhere. Contains the damage from any single breach.
• Multi-factor authentication, ideally a passkey or hardware key. Phishing-resistant factors defeat attacks that a strong password cannot, because a stolen password alone stops being enough.
• A password manager. The only practical way to hold hundreds of unique random passwords. Give it a long passphrase and its own second factor.
• Length on the ones you must memorise. Your device unlock, your manager’s master password, your email. Those few should be six-word passphrases.
• Breach monitoring. Rotate on evidence, not on a schedule.

Notably, none of the top items is about making an individual password more baroque. Uniqueness and a second factor do far more work than any amount of punctuation.