What Makes a Password Truly Strong?

Every week, millions of accounts are compromised because of weak passwords. Despite years of warnings, "123456" and "password" remain two of the most used passwords in the world. But what actually makes a password strong — and why do so many "clever" passwords fail?

What Makes a Password "Strong"?

A strong password has one core property: it is unpredictable. Security researchers measure this as "entropy" — the number of possible combinations an attacker would need to try before guessing your password. The higher the entropy, the stronger the password.

Three factors control entropy:

• Length — every additional character multiplies the number of possible combinations
• Character set size — using uppercase, lowercase, numbers, and symbols gives attackers a larger space to search
• Randomness — truly random passwords have no patterns to exploit

Why Length is the #1 Factor

Length matters more than anything else. Here is why: adding one character to a password multiplies the number of possible combinations by the size of the character set.

If you use a 62-character set (A–Z, a–z, 0–9), going from 8 to 16 characters does not double the security — it squares it. The math is exponential, which is why a 20-character password with only lowercase letters is stronger than an 8-character password with all four character types.

The Randomness Problem

Human brains are terrible at generating randomness. When asked to create a random password, people tend to:

• Start with a capital letter and end with numbers or symbols
• Use real words with "leet speak" substitutions (p@ssw0rd)
• Include personal information (birthdays, pet names, sports teams)
• Use keyboard patterns (qwerty, 123456)

Attackers know all of these patterns. Modern cracking tools use "rule-based attacks" that test all common substitutions (@ for a, 0 for o, ! at the end) before brute-forcing random combinations. A password like "P@ssw0rd123!" — which passes many "strength meters" as strong — is typically cracked within minutes.

True randomness requires a computer. Our password generator uses the browser's crypto.getRandomValues() API — hardware-seeded cryptographic randomness — to eliminate all patterns.

Character Variety Explained

Using all four character types (uppercase A–Z, lowercase a–z, digits 0–9, and symbols) increases the character set from 26 to 95 possible characters per position. For a 16-character password:

• Lowercase only: 26^16 = 43 quadrillion combinations
• All four types: 95^16 = 440 trillion trillion combinations

That said, at 16+ characters, even a lowercase-only random password is extremely strong. Character variety matters more for shorter passwords.

Common Password Myths Debunked

Myth: "Changing passwords regularly makes them more secure."
Reality: Frequent mandatory password changes actually reduce security — users create predictable patterns like "Password1", "Password2". Change passwords only when there is a specific reason (breach, sharing, compromise).

Myth: "Complex passwords with symbols are always strong."
Reality: "Tr0ub4dor&3" — famously used in the XKCD comic — is less secure than four random common words because it follows predictable substitution rules.

Myth: "I can remember a strong password."
Reality: Any password you can memorise is likely not random enough. Use a password manager and generate truly random passwords for every account.

How Long Does It Take to Crack?

Modern GPU clusters can test billions of passwords per second. Here are approximate cracking times for a dedicated attacker:

• 8 characters, mixed types: 8 hours to a few days
• 12 characters, mixed types: Hundreds of years
• 16 characters, mixed types: Trillions of years
• 20+ characters, mixed types: Longer than the age of the universe

How to Create and Store Strong Passwords

The practical steps are simple:

• Generate, don't invent: Use our free password generator to create a truly random password. Set length to 16+ and enable all character types.
• Never reuse: Every account gets a unique password. If one site is breached, all others remain safe.
• Store safely: Use a reputable password manager — Bitwarden (free, open-source), 1Password, or KeePass. Never store passwords in browser autofill on shared devices.
• Add 2FA: A strong password plus two-factor authentication makes an account nearly impossible to breach remotely.
• Check for breaches: Use our Email Breach Checker to see if your credentials have appeared in known data leaks.

The bottom line: a 16+ character random password stored in a password manager with 2FA enabled is the gold standard for account security. Our tools make achieving that standard free, fast, and simple.

Related articles: Best Free Password Managers → · SMS vs Authenticator App → · 10 Password Mistakes →