What actually makes a password strong

Length beats complexity, and it is not close

The classic rule asked for a capital, a number and a symbol, and it produced a generation of passwords that look like P@ssw0rd!. That string satisfies every complexity requirement on the form and it is one of the first things a cracking tool tries, because the substitutions are not creative. Everyone reaches for the same ones: a for @, o for 0, s for $, an exclamation mark on the end.

Cracking software has encoded those rules for two decades. It takes a dictionary word, applies the twenty most common mangling patterns, and works through them before it ever attempts anything genuinely random. Complexity requirements did not make passwords unpredictable. They made them predictable in a slightly noisier way.

What actually resists guessing is unpredictability, and the cheapest way to buy unpredictability is more characters. Adding one random character to a lowercase password multiplies the search space by 26. Adding a full symbol set to a short password multiplies it by less than four per character. Length compounds. Variety does not.

Entropy, in bits, with real numbers

Entropy is a measure of how many equally likely possibilities a secret was drawn from, expressed in bits. Each extra bit doubles the number of guesses an attacker has to make. It is the only honest way to compare a passphrase against a jumble of symbols, because it ignores what the thing looks like and counts only how it was chosen.

A random four-word passphrase drawn from the standard 7,776-word diceware list carries about 51.7 bits. Five words carry about 64.6 bits. A random twelve-character password drawn from the full 95-character printable set carries about 78.8 bits. Those numbers are just arithmetic on the size of the pool and the number of picks.

Notice what that comparison actually says. A five-word passphrase you can say out loud beats a random eight-character symbol soup, and the twelve-character random string beats both while being impossible to memorise. That is the real trade: memorable passphrases for the handful of secrets you must recall, long random strings from a password generator for everything else.

What entropy will not give you is a time to crack. That figure depends entirely on the attacker hardware and, far more, on how the site stored your password. A slow, purpose-built password hash may allow thousands of guesses per second; a fast general-purpose hash may allow billions. The same password can be uncrackable on one service and gone in an afternoon on another, and you do not get to find out which.

Entropy only counts if the choice was genuinely random

This is the part people skip, and it quietly destroys the maths. Those bit counts assume every word or character was picked uniformly at random from the pool. If you chose the words yourself, you did not do that.

A sentence you invented, like "purple monkey dishwasher toast", feels random and is not. You picked words you know, in an order that felt natural, avoiding ones that seemed awkward. Human word choice clusters heavily around a few thousand common words with grammatical structure between them, so a self-composed four-word phrase is worth a fraction of the 51.7 bits the format suggests.

The fix is boring: let software do the picking. A passphrase generator selects words with no preference at all, which is precisely why the result often feels wrong to you. That discomfort is the entropy. If you find yourself regenerating until you get a phrase you like, you are hand-picking again and giving the bits back.

The same applies to characters. People asked to type a random string produce home-row patterns, birth years and keyboard walks. Use a random string generator instead, and if you want a sanity check on something you already use, run it through a password strength checker before trusting it.

Forced 90-day rotation was formally abandoned

The quarterly password change is one of the most durable bad ideas in security, and it was dropped from the United States federal guidance, NIST SP 800-63B, back in 2017. The reasoning was straightforward: it was measurably making things worse.

People do not respond to forced rotation by inventing a new strong secret every quarter. They respond with a predictable sequence: Summer2025!, then Autumn2025!, then Winter2025!. An attacker who obtains one of those has effectively obtained all of them, because the transformation rule is obvious. Rotation also pushes people towards shorter, simpler passwords, since anything complicated is painful to relearn four times a year.

Current advice is to change a password when there is a reason: a breach notice, a shared credential after someone leaves, a suspicion that a device was compromised, or a password you typed into something that turned out to be a phishing page. Otherwise, a long random unique password should live until it has a reason to die.

Reuse is what actually gets people

Almost nobody is targeted by someone patiently brute-forcing their password. The realistic attack is credential stuffing. A service you signed up to years ago gets breached, the email and password pairs end up in a compiled list, and automated tooling replays those pairs against banks, email providers, shopping sites and social accounts at enormous scale.

The password itself does not need to be weak for this to work. It needs to be reused. A 78-bit random string that you also used on a hobby forum in 2016 is worth exactly as much as that forum was careful, which is to say nothing.

That is why a password manager beats memorisation, and it is not close. You cannot remember two hundred unique random strings, so if you rely on memory you will reuse, and reuse is the failure mode that actually happens. A manager reduces the problem to one very strong passphrase plus two-factor on the vault, and it has a useful side effect: it will not fill your credentials into a lookalike domain, so it catches phishing your eyes miss.

Second factors, ranked honestly

A hardware security key or a passkey is the strongest option available. It is bound to the real site, so a convincing fake page cannot harvest anything usable. If a service supports it and you care about the account, use it.

An authenticator app generating six-digit codes is the good middle ground. It works offline and it is not tied to your phone number, which matters more than people expect. Its weakness is that a code can be typed into a phishing page in real time, so it protects against stolen passwords far better than it protects against a well-built fake login screen.

Text-message codes are the weakest common second factor, because a phone number can be moved to an attacker via a persuasive call to a mobile provider, and messages can be intercepted on the network. But weakest is not worthless. A stolen password alone will not open an account protected by a texted code, so if that is all a service offers, turn it on.

What this comes down to

Install a password manager and let it generate everything. Protect it with a five or six word randomly generated passphrase and a second factor, and accept that this one secret is the thing you actually have to memorise.

Make every password unique, because uniqueness defends against the attack that genuinely happens. Make it long, because length is where the bits come from. Stop changing passwords on a calendar and change them on evidence.

And be suspicious of anything that feels clever. Substituting a 3 for an e, appending your birth year, or building a personal formula across sites all feel like ingenuity and are all patterns that software enumerated long ago. Randomness is unglamorous, which is exactly why it works.