How strong is your password, really?

Almost everyone has been told the same rules: at least eight characters, one capital, one number, one symbol. Those rules produced a generation of passwords like Summer2024! — genuinely unpleasant to type, and considerably weaker than they look.

The rules were not arbitrary. They were a reasonable response to the passwords people chose in the 1990s, when password and qwerty dominated every leaked database. But they optimised for the wrong variable, and the consequences are still with us.

What actually makes a password hard to guess

Password strength is measured in bits of entropy, which sounds abstract but means something simple: the number of guesses an attacker would have to make, expressed as a power of two.

Each additional bit doubles the work. Twenty bits is about a million possibilities. Forty bits is about a trillion. Seventy bits is more than a billion trillion.

The formula has two inputs: the size of the character pool, and the length.

entropy = length × log₂(pool size)

Note where each sits. Pool size is inside a logarithm — growing it has diminishing returns. Length is a multiplier. This is the whole argument in one line.

Adding character types grows the pool: lowercase alone is 26, adding uppercase makes 52, adding digits 62, adding symbols about 94. That takes you from 4.7 bits per character to 6.6 — a 40% improvement, which sounds decent until you compare it with the alternative.

The all-lowercase passwords win, comfortably, because length multiplies while complexity only nudges.

The part the formula does not capture

Those numbers assume every character was chosen randomly, and that is where human-chosen passwords fall apart.

Summer24! is not a random nine-character string from a 94-character pool. It is a common word, a year, and the symbol that sits on the 1 key — the single most likely symbol anyone appends. An attacker does not brute-force it character by character. They run a dictionary of common words, apply a standard set of transformations, and append years and popular symbols.

That reduces the real search space from 59 bits to something closer to 25. Software has been doing exactly this for twenty years. The transformations everyone thinks are clever — 3 for e, @ for a, 0 for o, a capital at the start, a number at the end — are in the default rule set of every password-cracking tool that exists.

This is the fundamental problem with the complexity rules. They pushed people toward a small number of predictable patterns, and the resulting passwords are hard for humans and easy for machines. Precisely backwards.

How fast passwords actually fall

The numbers depend enormously on how the service stored the password, which is entirely outside your control.

Against a fast hash like MD5 or SHA-1 — which no service should still use for passwords, and some do — commodity hardware manages tens to hundreds of billions of guesses per second.

Against a properly slow algorithm designed for passwords — bcrypt, scrypt, Argon2 — the same hardware manages tens of thousands. That is a difference of roughly seven orders of magnitude, from one design decision you will never be told about.

At 100 billion guesses per second, assuming a genuinely random password:

The jump between rows is the doubling at work. Ten more bits is a thousand times more effort.

Aim for 70 bits or more on anything that matters, and note that this is achievable with a 16-character random password or a six-word random passphrase.

Passphrases

A passphrase is several random words joined together. harbor-lantern-quartz-meadow-bison-drift is easier to type on a phone, easier to read aloud, and easier to remember than an equivalent random string.

Its strength depends entirely on the words being chosen randomly from a known list, and on how large that list is. With a list of about 2,000 words, each word contributes roughly 11 bits. Six words is about 66 bits; eight is about 88.

The critical caveat: this only holds if a computer picked the words. A phrase you invent yourself is nowhere near as strong, because human word association is highly predictable — people reach for related words, common nouns, and phrases that already exist. "Random" chosen by a person is not random.

And note that entropy assumes the attacker knows exactly how the passphrase was made — which list, how many words, what separator. That is the correct assumption. Security should never depend on the method being secret.

What actually matters, in order

1. Never reuse a password. This is more important than everything else combined. A strong password used across three services fails at all three the moment any one is breached, and credential-stuffing attacks — taking leaked pairs and trying them everywhere — are among the most common attacks in existence. A merely decent unique password beats an excellent shared one.

2. Use a password manager. Which is the only practical way to achieve the first point. It generates locally, stores encrypted, and removes the reason people reuse passwords. The objection — "what if it gets breached" — is real but backwards: an encrypted vault protected by one strong passphrase is a far better position than the same passwords scattered across fifty services with varying competence.

3. Turn on two-factor authentication. It protects the account even when the password is compromised, and it matters considerably more than the difference between a good password and a great one. An authenticator app is better than SMS, which is vulnerable to SIM-swap attacks.

4. Make it long. Sixteen characters or more, or six-plus random words.

5. Stop rotating on a schedule. Forced periodic changes push people toward predictable increments — Summer2024, then Summer2025. NIST removed this recommendation years ago. Change a password when there is a reason: a breach, a shared device, a suspicion.

Where strength meters mislead

Most strength meters score appearance rather than unpredictability. They count character classes and length, and reward anything that looks scrambled.

That makes them easy to fool in both directions. P@ssw0rd1 scores well on many meters and falls in seconds. thistrainarrivesatnine scores poorly on some and is genuinely strong.

A meter is only meaningful if it either evaluates against known-common passwords and patterns, or reports actual entropy for a password it generated and therefore knows the method behind. The password generator here does the second: it reports entropy for its own output, where the calculation is honest because the generation method is known.

One deliberate detail worth mentioning, because it illustrates the principle. The generator can append a digit to a passphrase, for sites that demand a number — but it does not count that digit toward the entropy. It sits in a known position, drawn from ten options, and any attacker targeting passphrases would try it as a matter of course. Counting it would inflate the figure by three bits it does not deserve. Overstating security is worse than understating it.