How to choose a strong password (and why yours probably isn't)

The password advice most of us learned — eight characters, one capital, one number, one symbol, change it every 90 days — was formalised in a US government guideline in 2003. Its author later said publicly that he regretted it. The rules pushed people towards passwords that are hard for humans to remember and not especially hard for computers to guess.

Here is what the maths actually says.

Strength is measured in entropy

A password's resistance to guessing is measured in bits of entropy, and the formula is simple:

entropy = length × log₂(size of the character set)

A password drawn randomly from lowercase letters alone has log₂(26) ≈ 4.7 bits per character. Add uppercase and you are at 5.95. Add digits and symbols and you reach about 6.55 bits per character.

Every additional bit doubles the number of guesses required. So 60 bits is not 50% harder than 40 bits — it is about a million times harder.

Length beats complexity

Run the numbers on the two levers and one of them dominates.

Going from lowercase-only (4.7 bits/char) to all four character types (6.55 bits/char) multiplies the strength per character by about 1.4.

Adding a single character multiplies the total by the full size of the character set — 26×, 62×, 95×.

So:

The second one is only lowercase letters, contains no symbols, would fail most corporate complexity rules, and is around 70 billion times harder to guess.

Length is the lever. Complexity helps, but it helps far less than people assume, and it costs a great deal in memorability.

The catch with entropy

That formula assumes the password is chosen randomly. Human-chosen passwords are not.

P@ssw0rd1 looks like it has 9 characters from a 95-character set — about 59 bits. In reality it appears in every cracking dictionary ever assembled, along with every common substitution pattern (@ for a, 0 for o, 1 at the end). Its real strength is close to zero.

Attackers do not brute-force from aaaaaaaa. They start with leaked password lists, then apply the transformations people predictably use: capitalise the first letter, put the digits at the end, swap letters for lookalike symbols. A password built from a memorable word plus those rules falls in seconds.

This is why the entropy figure on a generated password is meaningful and the same figure on a chosen password is not. Randomness is doing the work.

How long is long enough?

At a realistic offline attack rate of around 100 billion guesses per second against a well-implemented hash:

Practical targets:

• 12 characters — a reasonable floor for anything that matters
• 16 characters — a good default
• 20+ characters — for email and banking, the accounts that can reset everything else

Since you are not memorising these, there is no reason to be conservative. A 24-character password is no more effort than a 16-character one when a password manager is typing it.

Reuse is the real vulnerability

Here is the uncomfortable part: password strength is often not what gets people compromised. Reuse is.

When a site is breached, the attacker gets a list of email addresses and passwords. The first thing they do is try those same pairs at every major email provider, bank and retailer. This is called credential stuffing, it is fully automated, and it does not care how strong your password was — it already has it.

A 30-character random password reused across five sites is weaker in practice than five mediocre passwords that are all different.

One unique password per site. This is the single highest-value rule, and it is also the one that makes a password manager non-negotiable, because nobody can hold hundreds of unique random strings in their head.

The passphrase option

For the handful of passwords you genuinely must type from memory — your device login, your password manager's master password — use a passphrase: four or more random words.

The word "random" is doing all the work. Words picked by you are not random; words picked by dice or software are. Four words from a 7,776-word list gives about 51 bits; six words gives about 77 bits, and is still something you can remember and type.

Rotation is mostly theatre

Forcing a password change every 90 days is now explicitly discouraged by NIST, and the reason is behavioural: people respond by incrementing a number. Summer2025! becomes Summer2026!. An attacker who has one guesses the next in one attempt.

Change a password when there is a reason to — a breach notification, a shared password, a suspicion. Otherwise a strong, unique password is fine indefinitely.

The short version

1. Use a password manager.
2. Generate a random 16+ character password for every site.
3. Never reuse one.
4. Turn on two-factor authentication where it is offered.
5. Use a long random passphrase for the two or three you must type yourself.

Steps 1 to 3 remove almost all of the real-world risk. The rest is refinement.