What Makes a Password Strong

Every character you add multiplies the number of possible passwords by the size of the character set, so length is the single most powerful lever you have. A 16-character password drawn from lowercase, uppercase, digits and symbols has roughly 10²² times more combinations than an 8-character one. That is why a long, boring password beats a short, 'complex' one every time: complexity adds a constant factor, length adds an exponent.

As a rule of thumb, 12 characters is a sensible minimum for everyday accounts, 16 is a comfortable default, and 20 or more is appropriate for a password manager's master password or anything protecting sensitive data.

Check the other end of the wire too. A service that refuses a 20-character password, or silently truncates it, is telling you how it stores passwords: correct storage hashes the input down to a fixed size, so extra length costs the server nothing. A low cap usually means an old schema behind the login form.

A long password is only strong if it is unpredictable. Attackers do not try 'aaaaaaaa' then 'aaaaaaab'; they start with dictionaries, leaked password lists, keyboard patterns and common substitutions. 'P@ssw0rd123!' is twelve characters but falls in seconds, because it is exactly the kind of string those attacks try first. True randomness — the kind you get from a cryptographic generator rather than from your own imagination — is what removes those shortcuts.

This is also why 'random-looking' is not the same as random. People asked to invent a random string alternate consonants and vowels, avoid repeated characters, and almost always begin with a letter — patterns a targeted attack can express as a handful of rules. A cryptographic generator has no preferences: every position is drawn independently, and repeats are allowed to happen.

Even a perfect password becomes a liability if you reuse it. When one site is breached — and breaches happen constantly — attackers take the leaked email-and-password pairs and try them on hundreds of other services automatically. This is called credential stuffing, and reuse is what makes it work. A unique password per account contains the damage of any single breach to that one account.

Unique random passwords are impossible to memorise at scale, which is exactly why a password manager pairs so naturally with a generator: the tool makes them, the manager remembers them.

If you are repairing existing accounts rather than starting fresh, work in order of blast radius: first the email address that receives everyone else's password-reset links, then anything holding money or identity documents, then the long tail.

Password advice makes far more sense once you separate the two attacks it defends against. Online guessing happens at the login form, where rate limits, lockouts and CAPTCHAs typically hold an attacker to a handful of attempts per account per hour, so even a mediocre password survives. Offline cracking happens after a database is stolen, when the attacker holds the hashes on their own hardware and the service can no longer slow anything down.

The gap between the two is enormous. A single current-generation GPU tests tens of billions of MD5 or SHA-1 guesses per second; against the same password stored with bcrypt at cost factor 12, that hardware manages only tens of thousands — around a millionfold difference. You never get to choose how a site stores your password, so the one variable genuinely in your hands is how many guesses it would take.

NIST Special Publication 800-63B, the reference most security teams follow, quietly retired the rules that shaped two decades of login forms. It advises against composition requirements (must contain an uppercase letter, a digit and a symbol), against forced periodic rotation, and against knowledge-based 'security questions'. In their place it asks services to accept at least 64 characters, to allow every printable character including spaces and Unicode, and to screen new passwords against lists of known-breached and obviously weak choices.

The reasoning is behavioural rather than mathematical. Composition rules push everyone toward the same few shapes — a capital at the front, a digit and an exclamation mark at the end — which narrows the search space instead of widening it, and scheduled rotation produces predictable increments. Screening against a breach list removes exactly the passwords attackers try first.

A password you cannot actually use is a password you will work around, so practical properties matter alongside the arithmetic. If you will have to read it aloud or type it on a television remote, turn off ambiguous characters — dropping l, I, 1, 0 and O costs a fraction of a bit per character and removes most transcription errors. If you will have to type it on a phone, a word-based passphrase is far less painful than a symbol-heavy string of the same strength.