Most password advice is about making a password look complicated: swap an “a” for an “@”, add an exclamation mark, capitalise the first letter. Attackers know every one of these habits, and their cracking tools try them first.
What makes a password hard to guess
Strength comes from the number of equally likely possibilities an attacker has to work through. Security people measure it in bits of entropy, and every extra bit doubles the work. The formula is short: the length of the password multiplied by log2 of the size of the pool of characters it is drawn from.
| Password | Pool | Entropy |
|---|---|---|
| 8 random lowercase letters | 26 | about 38 bits |
| 12 random lowercase letters | 26 | about 56 bits |
| 4 words from a 2,048-word list | 2,048 | 44 bits |
| 6 words from a 7,776-word list (Diceware) | 7,776 | about 78 bits |
| 20 random characters, all four types | 85 | about 128 bits |
These figures only hold when the choice is random. “Password1!” contains all four character types and is still among the first things a cracker tries, because a person chose it.
Length matters more than symbols
Take an 8-character password made of letters and digits, a pool of 62. Adding symbols raises the pool to about 85 and gains roughly 3.6 bits. Adding one more character gains about 6.4 bits. Making a password longer almost always does more than making it stranger.
Rules that no longer help
The US National Institute of Standards and Technology publishes the widely followed digital identity guidelines (SP 800-63B). They advise against forced composition rules such as “must include a symbol”, and against forcing routine password changes when there is no sign of compromise. They recommend checking new passwords against lists of known breached passwords, and allowing long passphrases. Rules that push people toward predictable patterns make passwords weaker, not stronger.
The real risk is reuse
When one website is breached, attackers try the leaked email and password on banks, shops and email providers. This is called credential stuffing, and it works because people reuse passwords. A unique password for every account defeats it, which is why a password manager matters more than any single clever password.
A routine that works
- Let a random generator create every password, at 16 characters or more, and store them in a password manager.
- Memorise only two things: the manager’s master passphrase (five or six random words) and your email password.
- Turn on two-factor authentication for email, banking and the manager. An authenticator app, passkey or security key is stronger than a text message.
- Change a password when a service reports a breach, not on a calendar.
- Turn on “skip look-alikes” if you ever have to type a password by hand, so I, l, 1, O and 0 cannot be confused.
Try it yourself: Open the password generator