You’ve seen the rules a thousand times: your password must contain at least one uppercase letter, one lowercase letter, one number, and one special character. Must be at least 8 characters. Cannot contain your username. Cannot be a previously used password.
These rules feel like security. They are mostly theater.
The person who originally wrote the influential NIST guidelines recommending complex passwords, Bill Burr (a 2003 special publication), later told the Wall Street Journal he regretted it. “Much of what I did I now regret,” he said in 2017. NIST has since reversed course. Their current guidelines explicitly recommend against complexity requirements and instead emphasize length and checking passwords against known breached lists.
So what actually makes a password strong? To answer that, you need to understand how passwords are attacked.
How Passwords Are Actually Cracked
When attackers get a database of password hashes (the scrambled versions of passwords that websites store), they don’t try to “unscramble” the hashes. Hashing is a one-way function; you can’t reverse it. Instead, they try millions or billions of guesses, hash each guess, and compare it to the stolen hashes.
The methods, roughly in order of sophistication:
Dictionary Attacks
Start with a list of common passwords (there are publicly available lists with millions of entries from previous breaches) and hash each one. This catches anyone using “password123,” “qwerty,” “iloveyou,” or any of the other passwords that millions of people independently choose. If your password is a common English word or phrase, it falls here.
Rule-Based Attacks
Take the dictionary and apply common substitutions and patterns: replace “a” with “@”, “e” with “3”, “s” with “$”, capitalize the first letter, add a number at the end. This is why “P@ssw0rd1” is not a strong password despite meeting every complexity requirement you’ve ever seen. Attackers know people do this, and their tools automate it.
Brute Force
Try every possible combination of characters up to a certain length. This is the slowest approach but the most thorough. For short passwords, it’s fast. For long passwords, it becomes impractical. This is where math becomes your friend.
The Math of Password Entropy
Password strength is measured in bits of entropy, which is essentially a measure of how many guesses an attacker would need to try, on average, to crack it. More entropy means more guesses required.
The formula is straightforward: entropy = log₂(possible characters ^ password length).
For a password using lowercase letters only (26 characters), each character adds about 4.7 bits of entropy. Add uppercase (52 total characters), and each character adds about 5.7 bits. Add digits and common symbols (roughly 95 printable ASCII characters), and each character adds about 6.5 bits.
Here’s the thing people miss: length contributes exponentially, while character set contributes logarithmically.
An 8-character password using all 95 printable characters has about 52 bits of entropy. A 12-character password using only lowercase letters has about 56 bits. The longer, simpler password is harder to crack.
A 16-character password using only lowercase letters has about 75 bits of entropy. An 8-character password cannot reach that level no matter what characters you use.
Length wins. It always wins. A longer password made of simple characters beats a shorter password made of complex characters, every time.
Why “Correct Horse Battery Staple” Works
The webcomic xkcd illustrated this in a now-famous strip: four random common words strung together (“correct horse battery staple”) produce a password that is both easier to remember and harder to crack than a short, complex password like “Tr0ub4dor&3.”
The math checks out. If you pick 4 words randomly from a list of 2,000 common words, you get about 44 bits of entropy (2,000⁴ = about 1.6 × 10¹³ possibilities). Five words from the same list gives about 55 bits. Six words gives about 66 bits. And unlike “Tr0ub4dor&3,” you can actually remember “correct horse battery staple” without writing it on a sticky note.
The critical word in this approach is “random.” You must pick the words randomly, not choose them yourself. Humans are terrible at being random. We pick words that relate to each other, that are personally meaningful, or that come from a small mental vocabulary. A truly random four-word passphrase is strong. A self-selected four-word phrase like “I love my dog” is not.
What “Strong Enough” Means in Practice
How much entropy do you actually need? It depends on what’s protecting the password.
Online attacks (trying to log into a website): Most sites lock you out after 5-10 failed attempts, or at least rate-limit tries to a few per second. Against that kind of throttling, even 30-40 bits of entropy is practically uncrackable. A random 6-character password would technically survive, though you shouldn’t cut it that close.
Offline attacks (cracking stolen hashed passwords): This is where strength actually matters. Modern GPUs can compute billions of hashes per second for weak algorithms like MD5 or SHA-1. Against proper hashing (bcrypt, scrypt, Argon2), the rate drops to thousands or millions per second. You want at least 60-80 bits of entropy for passwords protecting important accounts, assuming the service might be using mediocre hashing.
Key derivation (encryption keys): If your password is protecting encrypted data, like a password manager’s master password or full-disk encryption, aim for 80+ bits. It’s your last line of defense if the encrypted data is stolen.
The Practical Advice
Use a password manager. Generate a unique random password for every account. The passwords can be 20+ characters of random gibberish because you never need to type or remember them. Honestly, this one change does more for password security than anything else.
Make your master password a long passphrase. The one password you do need to remember (your password manager’s master password) should be a randomly generated passphrase of 5-6 words. Memorize it. Don’t write it down where someone could find it.
Length over complexity. If a site forces you to create a memorable password without a password manager, make it long. A 20-character lowercase passphrase is stronger than an 8-character symbol soup.
Check if your password has been breached. Services like Have I Been Pwned maintain databases of passwords exposed in data breaches. If yours appears in one, change it. Attackers use these lists as their first stop.
Enable two-factor authentication. A strong password combined with a second factor (an authenticator app, not SMS) means an attacker needs both your password and your physical device. That matters, because even a strong password can be phished.
Generate a Strong Password
Try the Password Generator on ToolzHQ to create random passwords at whatever length and character set you need, then store them in your password manager rather than trying to remember them.