What Makes a Strong Password? Length, Randomness, and Common Mistakes

Length beats complexity

Password strength is measured in entropy — roughly, how many guesses an attacker would need. Every added character multiplies the guesses required, so length is the single biggest factor.

An 8-character password with symbols can be cracked by modern hardware in hours. A 16-character random password would take longer than the age of the universe. When in doubt, add characters.

How passwords actually get cracked

Attackers don't guess one password at a time by hand. They use leaked databases of real passwords, dictionary lists with common substitutions (p@ssw0rd is in every list), and hardware that tries billions of combinations per second.

This is why "clever" substitutions don't help, and why reusing passwords is so dangerous: if one site you use is breached, attackers try that same email and password on every other major site within hours.

The three rules that matter

Modern password advice comes down to three habits:

• Make it long — 16 characters or more for anything important.
• Make it random — let a generator pick the characters; humans are terrible at randomness.
• Make it unique — never reuse a password across sites. A password manager makes this practical.

Passphrases: the memorable alternative

For passwords you must type from memory (like your computer login or password manager's master password), use a passphrase: four or five random, unrelated words, like "correct horse battery staple". A five-word passphrase is both stronger than most complex passwords and far easier to remember.

Add a second layer

Even the strongest password can be stolen by phishing or a data breach. Turn on two-factor authentication (2FA) for email, banking, and any account that would hurt to lose. An authenticator app is more secure than SMS codes.