What actually makes a password strong?

Why length beats complexity

The strength of a password is the number of possibilities an attacker has to work through, and that number grows exponentially with length and only linearly with the size of the character set. Adding one character multiplies the search space by the size of the alphabet. Adding symbols to the alphabet multiplies it once.

A password using lowercase letters only has 26 possibilities per character. Add uppercase, digits and symbols and you reach roughly 95. That sounds like a large improvement, and per character it is — but going from eight characters to twelve at 26 possibilities each multiplies the space by about 457,000, which dwarfs it.

This is why the familiar advice produces weak passwords. "At least eight characters with an uppercase, a number and a symbol" describes a space small enough to be searched exhaustively by ordinary hardware, and it pushes people toward predictable constructions — a capital at the front, a digit and an exclamation mark at the end — that reduce the real space far below the theoretical one.

A four-word passphrase drawn at random from a list of a few thousand words is both far stronger and far easier to remember than anything that fits the traditional rule. The current guidance from NIST reflects this: it recommends allowing long passphrases, dropping mandatory composition rules, and abandoning periodic forced changes, all of which were shown to make real-world passwords worse rather than better.

The tricks that no longer work

Substituting characters — a zero for an o, a three for an e, an at sign for an a — feels like it adds difficulty. It does not. Every serious cracking tool applies those substitutions as a standard rule set, so "P@ssw0rd" is tested at essentially the same moment as "password". The transformation is public knowledge and takes no meaningful extra time.

The same applies to appending a digit or a year, capitalising the first letter, and adding an exclamation mark at the end. These are the most common mutations in every leaked password corpus, and they are the first ones tried after the base word itself.

Keyboard patterns are worse than they look. "qwerty", "1qaz2wsx", "zxcvbnm" and their variants are short, memorable, feel random on the fingers, and are all in the standard wordlists. So are the obvious dates: a birth year, the current year, and anniversaries appear constantly.

The deeper problem is that any password a person invents follows human patterns, and cracking tools model those patterns directly rather than brute-forcing blindly. That is why generated passwords are stronger than chosen ones at the same length — not because people choose badly by intention, but because a real random source has no pattern to model.

Reuse is the bigger risk

For most people, password strength is not actually the thing that gets them compromised. Reuse is.

When a site is breached, the credentials end up in a compiled list. Attackers then try those exact combinations against hundreds of other services, which is called credential stuffing, and it works because a large fraction of people use the same password in more than one place. The strength of the password is irrelevant to this attack — the attacker already has it.

This is why uniqueness matters more than complexity. A merely decent password used on one account only is safer in practice than an excellent one used on five, because the second is compromised the moment any of those five is.

Remembering a different strong password for every account is not possible without help, which is what a password manager is for. It generates long random passwords, stores them encrypted behind one strong passphrase, and fills them only on the matching domain — which as a side effect defeats most phishing, because the manager will not offer a credential to a lookalike address the way a person would type it in.

Two-factor authentication is the other half. It means a stolen password alone is not enough. App-based codes and hardware keys are considerably stronger than SMS, which can be intercepted by persuading a mobile operator to transfer a number, but any second factor is a substantial improvement on none.

What to do

Use a password manager and let it generate. Twenty random characters is cheap when you are not typing it from memory, and there is no reason to economise.

For the handful you must remember — the manager's own passphrase, your device login, your primary email — use a long passphrase of several unrelated words. Choose them randomly rather than composing a sentence, because a phrase that means something follows language patterns and is far more guessable than its length suggests.

Turn on two-factor authentication everywhere it is offered, and prioritise email first. Email is the recovery route for everything else, so whoever controls it can reset most of your other accounts regardless of how strong those passwords are.

Do not change passwords on a schedule unless you have a reason to think one is exposed. Forced rotation reliably produces predictable increments — the same password with a rising number on the end — which is weaker than leaving a strong one alone. Change immediately if a service reports a breach, and check whether your addresses appear in known breach data.

Where a service offers passkeys, take them. A passkey replaces the password with a key pair: the private half stays on your device and never leaves it, and the site stores only the public half, which is useless to an attacker who steals the database. Because nothing shareable is transmitted, a passkey cannot be phished, reused across sites, or leaked in a breach — it removes the whole category of problem rather than making it harder.

Finally, treat security questions as passwords rather than as questions. Mother's maiden name and first school are often public or guessable, and they bypass the password entirely. Generate a random answer and store it alongside the password.

Questions