What makes a password strong: length beats complexity

A password is strong when guessing it would take an unreasonable amount of computing work, and the cheapest way to buy that work is length. A sixteen character phrase made of ordinary words is harder to break than an eight character password crammed with symbols, even though the short one looks more secure to a person. If you want a single rule to carry away: at least 15 characters, a different one on every account, and never built from something a stranger could learn about you.

What an attack on your password actually looks like

There are two completely different situations, and they explain almost every piece of confusing advice you have read.

The first is online guessing. Someone types passwords into the real login page. Services limit this: a few wrong attempts and you get a delay, a captcha, or a lockout. At that speed, even a mediocre password survives, which is why attackers rarely sit there guessing. They prefer credential stuffing, where they replay passwords already leaked from another site, which no amount of complexity helps with, or they persuade you to type the password into a page that imitates the real login.

The second is offline cracking, and this is the one that sets the bar. A company gets breached and the attacker walks away with the password file. Passwords in that file are normally hashed, meaning each one has been run through a one way scrambling function that cannot be reversed. So the attacker guesses: take a candidate password, hash it, see if the result matches. That loop runs on the attacker's own hardware with no lockout and no delay, and against an old fast hashing method it runs at speeds measured in billions of guesses per second. Modern, deliberately slow hashing slows that down enormously, but you have no way of knowing which one a given website uses. For more on what leaks and why it matters years later, see what a data breach actually is.

Cracking tools already know your tricks

Nobody cracking passwords starts at aaaaaaaa and counts upward. They start with lists of real passwords from previous breaches, then apply transformation rules to each one.

Those rules are exactly the tricks people think are clever: capitalize the first letter, put a number on the end, add an exclamation mark, replace a with @, e with 3, o with 0, i with 1, or add the current year. A tool can run thousands of such rules over a dictionary of millions of words in moments.

This is why Tr0ub4dor&3 is a weak password despite looking fierce. Strip the decoration and it is one dictionary word plus a handful of the most common rules in the book. The same goes for your street name with a birth year, your football team plus 2026, or a child's name with a capital and a bang on the end.

Length is the one thing that scales

Every character you add multiplies the number of possibilities, and multiplication wins races that addition cannot.

Add one lowercase letter to a password and the search space grows 26 times. Add one character drawn from the whole keyboard and it grows about 95 times. So adding a symbol to an eight character password multiplies the attacker's work by roughly 95. Adding four more random lowercase letters instead multiplies it by 26 to the power of four, which is 456,976. Same effort from you, several thousand times more work for the attacker.

Notice the last two. The reason a four word phrase can be strong is not that words are magic, it is that the words were picked by dice or software from a large list rather than by a human brain reaching for a favorite lyric. That mechanic is worth understanding properly, and passphrases explained covers how to build one that actually holds up.

Why 15 characters, and why unique matters more than clever

Current guidance from standards bodies has moved the same direction for years. The recommendation to services is now to allow long passwords, check them against lists of known breached passwords, and stop forcing periodic changes and rigid character class rules. Fifteen characters is the sensible floor for anything you type yourself. Twenty or more random characters is the right setting for anything filled in automatically.

Uniqueness matters even more than strength. A perfect 30 character password used on two sites is only as safe as the weaker site. When that site leaks, attackers replay the pair against email, banking and shopping accounts automatically, which is the mechanism explained in password reuse.

Personal details are the last trap. Names, birth years, pet names, house numbers and anniversaries all sit in public profiles and in old breach records, and a targeted attacker can build a custom word list from them in an afternoon.

A workable system for a normal person

1. Install a password manager and let it generate 20 character random passwords for everything you do not type by hand. See password managers explained for how the vault protects them, and if you would rather not install anything, the one already built into your browser still beats reusing a password.
2. Choose three or four passwords you must actually remember, such as your manager's master password, your device unlock and your main email, and make each a random passphrase of five or six words.
3. Fix the accounts that matter first: email, then banking and payment, then anything holding a saved card.
4. Turn on two-factor authentication on those same accounts, because a second factor stops a stolen password from working on its own.
5. Never recycle a password, not even with a number changed at the end.

What to check first today

Open your email account settings and look at when the password was last changed and how long it is. Email is the master key, because it can reset almost everything else. If that password is under 15 characters, or you have used it anywhere else, or it contains a name or a year, change it now and let a generator do the work. Then repeat for your bank. Those two accounts carry more risk than the next fifty combined.