What Actually Makes a Password Strong

Password strength has a precise definition, and it has nothing to do with capital letters or numbers as such. Strength is entropy: the number of guesses an attacker must make, expressed in bits.

where L is the length and R is the size of the character set. Each bit doubles the work required.

The character-set arithmetic

Character set	R	Bits per character
Digits only	10	3.32
Lowercase	26	4.70
Upper + lower	52	5.70
Alphanumeric	62	5.95
Alphanumeric + symbols	95	6.57

Note how little the character set buys you. Moving from lowercase-only to the full 95-character set adds 1.87 bits per character. Adding one character of lowercase adds 4.70. Length dominates, and it is not close.

An eight-character password using all 95 characters gives 52.6 bits. A twelve-character lowercase-only password gives 56.4 bits: stronger, and enormously easier to type.

The formula assumes randomness, and humans are not random

That equation only holds if every character is chosen independently and uniformly. Human-chosen passwords are nothing like that.

Real passwords cluster around dictionary words, names, dates, keyboard patterns and a small set of substitutions. Attackers know this and do not brute-force the full space. They run:

1. Leaked password lists first: hundreds of millions of real passwords from past breaches.
2. Then dictionary attacks with rules: words plus common mutations such as capitalising the first letter, appending a year, swapping a for @, or adding ! at the end.
3. Pattern attacks on qwerty runs, keyboard walks and repeated characters.
4. Targeted guesses built from your employer, your pet or your birth year, harvested from social media.
5. Brute force only as a last resort, and only for short passwords.

P@ssw0rd1! is ten characters from a 95-character set: 65.7 bits on paper. Its real entropy is close to zero, because it is a single dictionary word with the four most predictable substitutions and appears in every wordlist ever compiled. Cracking tools find it instantly.

How complexity rules made things worse

Bill Burr wrote the NIST guidance in 2003 that introduced mandatory mixed case, digits, symbols and 90-day rotation. He publicly regretted it in 2017. The problem is that the rules constrain the space of passwords people actually choose, in ways attackers can model.

Told to include an uppercase letter, people capitalise the first. Told to include a digit, they append 1, or a year. Told to include a symbol, they append !. The result is a policy that pushes an entire user base into a narrow, well-known region of the search space.

NIST SP 800-63B, the current guidance, reverses most of it:

• Require a minimum length of 8, and allow at least 64.
• Accept all printable ASCII and Unicode, spaces included.
• Do not impose composition rules.
• Do not require periodic rotation without evidence of compromise.
• Do check candidates against lists of known-breached passwords.
• Do not use password hints or knowledge-based questions.

The shift is from constraining the shape of passwords to blocking the ones known to be compromised: a check that reflects how attacks actually work.

Passphrases

A random passphrase gets high entropy from length while remaining memorable. The Diceware method selects words at random from a list of 7,776, giving log₂(7776) = 12.9 bits per word:

Words	Entropy	Assessment
4	51.7 bits	Adequate for low-value accounts
5	64.6 bits	Good
6	77.5 bits	Strong: suitable for a password manager master key
7	90.4 bits	Beyond any foreseeable attack

The critical word is random. A phrase you composed yourself ("correct horse battery staple" is now in every wordlist) has far less entropy than the count suggests, because your word choice is not uniform over the dictionary.

Attack rates, in context

Against a leaked database, throughput depends entirely on the hash used. Rough orders of magnitude for a single modern GPU:

Stored as	Guesses per second	60-bit password
MD5	~100 billion	~4 months
SHA-256	~10 billion	~3.6 years
bcrypt (cost 12)	~1 thousand	~36 million years

The same password is either weak or unbreakable depending on a choice made by the service, not by you. This is worth remembering: your password strength is only half of the equation, and you control neither the hash nor the breach. See how hashing works for why bcrypt is so much slower by design.

Online attacks are a different regime entirely: rate limiting and lockouts cap them at a few thousand attempts, so almost any non-trivial password survives. The threat that matters is offline cracking after a breach.

What to actually do

1. Use a password manager and let it generate long random strings. You never type them, so length costs nothing.
2. Make the master password a 6-word random passphrase. It is the one you must remember, and 77 bits is comfortable.
3. Never reuse. Credential stuffing (replaying breached pairs against other services) is the most common account takeover method there is, and reuse is the only thing that makes it work.
4. Turn on a second factor wherever it is offered. An app-based TOTP code or a hardware key beats SMS, which is vulnerable to SIM swapping.
5. Check your addresses against breach databases and change anything that appears.
6. Prioritise. Your email account is the master key to everything else, because it can reset the rest. Give it the strongest protection you have.

The password generator uses your browser’s cryptographic random source rather than Math.random(), and, since a generated password only stays secret if it never leaves your machine, it runs entirely client-side.