How to Create a Strong Password, and Why Length Beats Symbols

How passwords are actually cracked

There are two very different attacks. In an online attack the attacker types guesses into a real login form or API. Rate limits, lockouts and CAPTCHAs cap them at somewhere between a few guesses an hour and a few per second, so only the most common passwords fall. In an offline attack the attacker has a stolen copy of a site's password database and guesses against it on their own hardware, with no limit except computing power. That is the attack strength is designed for, because breaches of large sites happen every year and the databases circulate for decades.

How fast an offline attack runs depends on how the site stored passwords. A database hashed with MD5, SHA-1 or the Windows NTLM hash can be attacked at tens of billions of guesses per second on a single rig of consumer graphics cards. A database hashed properly with bcrypt, scrypt or Argon2 slows the same rig to thousands or tens of thousands of guesses per second. You cannot see which a site uses, so a password has to survive the fast case.

Cracking tools do not start at aaaaaaaa and count upwards. They start with lists of real passwords leaked in earlier breaches, then apply the transformations people use: capitalise the first letter, swap a for @ and o for 0, append a year or !, join two dictionary words. Only after the likely candidates are exhausted do they fall back to brute force. That order is why P@ssw0rd2024!, with its upper case, digits and symbols, falls within seconds, while a string of lower-case letters chosen by dice can hold out for centuries.

Entropy: the only number that matters

The strength of a randomly generated password is easy to calculate. If each character is picked uniformly from a set of N symbols, and the password is L characters long, there are N^L possible passwords. Expressed in bits, the entropy is L × log₂(N). Each bit doubles the attacker's work; on average they need to try half the space.

Two things stand out. Adding symbols helps a little: going from letters and digits to the full set adds about 0.6 bits per character. Adding length helps a lot: every character adds the full 5 to 6.5 bits. A 16-character password using only letters and digits (95 bits) is stronger than a 12-character one using every symbol on the keyboard (79 bits). That is why NIST's current guidance, SP 800-63B, tells sites to stop forcing composition rules and to allow long passwords instead.

What do the numbers mean in time? At 10 billion guesses per second against a fast hash, a 50-bit password falls on average in under a day, 60 bits takes about two years, 70 bits about two thousand years, and 80 bits about two million years. Against bcrypt, divide those speeds by a million. A target of 80 bits or more for anything important leaves a large margin for faster hardware.

Why your own clever password is weaker than it looks

The entropy formula only applies when every character is equally likely. People do not choose like that. Given the rule "at least eight characters with a capital, a digit and a symbol", most people produce a word, capitalise its first letter, and put the digit and symbol at the end: Sunshine1!. Cracking tools encode exactly these habits as rules, so the effective search space is a few million candidates, not the 94¹⁰ the length suggests. Researchers analysing leaked databases consistently find that the realistic strength of human-chosen passwords is a small fraction of their apparent entropy.

The patterns to avoid are the ones cracking dictionaries prioritise:

• Common passwords and their variants, including leetspeak substitutions: password, P@ssw0rd, qwerty123, iloveyou.
• Keyboard walks such as qwertyuiop, asdfgh or 1qaz2wsx, which look random but are in every list.
• Dates and years, birthdays especially, appended to satisfy a "must contain a number" rule.
• Personal information: names of partners, children, pets, teams and streets, which an attacker targeting you can find online.
• The site's own name or a pattern like Amazon2024! and Netflix2024!, which turns one leaked password into all of them.

The fix is to stop choosing. Let a random generator pick the characters or the words. The strength checker in our password generator shows the difference directly: it finds these patterns in a typed password and prices them at their real guessing cost, so you can watch a "complex" password drop to a few bits.

Passphrases: strong and memorable

A random password is perfect for a password manager, which types it for you, but miserable for the few secrets you must remember: the manager's master password, your computer login, a disk-encryption key. For those, use a passphrase built with Diceware: pick words uniformly at random from a fixed list. With the Electronic Frontier Foundation's list of 7,776 words, each word adds 12.9 bits, so six words give about 77 bits and seven give about 90.

An example: stinky-rewrite-apricot-defy-jubilant-gravity. It is long, but easy to picture and to type on a phone. Its strength does not come from the words being unusual; it comes from the random selection. An attacker who knows you used the EFF list and six words still faces 7,776⁶ ≈ 2⁷⁷ combinations. The opposite is also true: a phrase you thought of yourself, a song lyric or a famous quote has almost no strength, because phrase dictionaries contain them.

Rules that actually protect you

1. Use a password manager. Bitwarden, 1Password, KeePassXC and the managers built into browsers and phones generate, store and fill passwords, so you never need to remember more than one.
2. Generate, don't invent. 16 or more random characters for everything the manager fills; 6 or 7 random words for the handful you type.
3. One password per site, always. Credential stuffing, replaying passwords leaked from one site against others, is the most common way accounts are taken over. Unique passwords make a breach on one site irrelevant to the rest.
4. Turn on two-factor authentication for email, banking and anything that can reset other accounts. Prefer passkeys or hardware security keys, which also resist phishing; an authenticator app is next best; SMS codes are better than nothing.
5. Change a password when there is a reason: a breach notice, suspected phishing, a shared device. Forced periodic changes encourage weak, incrementing passwords, which is why NIST no longer recommends them.
6. Check for exposure. Services that compare against known breached passwords, built into many browsers and password managers, will tell you when one of yours has appeared in a leak.

If you build the login form

The other half of password security is on the server. Hash passwords with Argon2id, scrypt or bcrypt with a per-user salt, never with a fast general-purpose hash and never with reversible encryption. Allow long passwords and every printable character, including spaces, so passphrases and manager-generated passwords work. Check new passwords against a list of known-breached passwords instead of imposing composition rules. Rate-limit and monitor login attempts, and support passkeys. Our guide to hashing, encryption and encoding explains why passwords must be hashed and what makes a hash suitable.

Frequently asked questions