How to Create a Strong Password: Why Length Beats Complexity

For years we were told that a strong password looks like Tr0ub&dor3: a dictionary word with a capital letter, a number swapped in for a vowel and a symbol on the end. It turns out that advice produced passwords that are hard for people to remember and easy for computers to guess. Here is what actually makes a password strong, and a simple system you can follow for every account you own.

How passwords really get cracked

Very few accounts are broken by someone typing guesses into a login form, since rate limits and lockouts make that painfully slow. The real danger is a data breach. When a website is breached, attackers usually get a database of password hashes. They then run billions of guesses per second against those hashes on their own hardware, with no rate limit at all.

Their guesses are not random. Cracking tools work through, in roughly this order:

1. Passwords leaked in earlier breaches (there are billions of them publicly available).
2. Dictionary words, names, places and sports teams, in many languages.
3. The same words with predictable "rules" applied: capitalize the first letter, add a year or ! at the end, swap a for @ and o for 0.
4. Only then, true brute force of every possible combination.

A password like Summer2026! technically contains uppercase, lowercase, digits and a symbol, yet it falls in step 3 within seconds. Complexity rules don't help if the result follows a pattern humans like.

Entropy: the number that matters

Security people measure password strength in bits of entropy: how many guesses, on average, it would take to find the password if the attacker knows exactly how it was generated. For a password made of truly random characters the formula is simple:

entropy = length × log2(number of possible characters)

Applying it to a few common choices:

Notice that doubling the length of an all-lowercase password adds more strength than adding every symbol on the keyboard to a short one. Each extra character multiplies the work an attacker has to do. That is why modern guidance, including NIST's digital identity guidelines, emphasizes length and screening against known-breached passwords over forced complexity rules.

Rule of thumb: aim for at least 80 bits for important accounts. A random 14-character password using letters, digits and symbols gets you there.

The catch: entropy only counts if it's random

The formula assumes every character was chosen randomly. A 16-character password you invented yourself, like ILoveMyDogMax2019, has nowhere near 100 bits, because it is made of predictable parts. Humans are terrible random number generators: we favor certain letters, keyboard patterns and meaningful dates.

That's why it is worth letting a computer choose. Our Password Generator uses the browser's cryptographically secure crypto.getRandomValues() function and shows the entropy of the result. Everything happens on your device, so the password is never sent anywhere.

A system that actually works

Strong passwords are useless if you reuse them. When one site is breached, attackers immediately try the same email and password on email providers, banks and shopping sites (an attack called credential stuffing). The practical answer has three parts:

1. Use a password manager. It generates and remembers a unique random password for every site, and fills it in for you. Bitwarden, 1Password, and the managers built into Apple, Google and Microsoft platforms are all solid choices.
2. Memorize just one or two strong passphrases. You need one for the password manager itself and perhaps one for your computer login. Five or six random words (chosen by dice or a generator, not by you) are strong and surprisingly easy to remember.
3. Turn on two-factor authentication for email, banking and your password manager. An authenticator app or a hardware security key protects you even if a password leaks. Passkeys, now supported by most major sites, go further still by removing the password entirely.

Quick answers to common questions

Should I change my passwords regularly?

Not on a schedule. Forced periodic changes push people toward predictable patterns like Password1, Password2. Change a password when there is a reason: the site was breached, you shared it, or you suspect someone else knows it.

What if a site limits password length or bans symbols?

Use the longest length the site allows. If symbols are banned, switch them off and add a few extra characters to compensate. Every additional character is worth more than any single character class.

Is it safe to write passwords down?

A paper note kept at home is safer than a reused password, since an online attacker cannot read your desk drawer. A password manager is better still, because it also protects against phishing by only filling passwords on the correct website.