What Actually Makes a Password Strong

The guidance that got withdrawn

In 2003, a manager at the US National Institute of Standards and Technology named Bill Burr wrote an eight-page appendix recommending that passwords mix upper and lower case, numbers and symbols, and be changed every ninety days. Organisations worldwide adopted it. It became the default configuration of essentially every corporate system.

In 2017 Burr told the Wall Street Journal he regretted it. NIST had by then published Special Publication 800-63B, which reversed the advice: no mandatory composition rules, no scheduled expiry, and a strong emphasis on length. The reasoning was simple. Fourteen years of data showed what people actually do when forced to comply.

Told to add a capital, they capitalise the first letter. Told to add a number, they append 1. Told to add a symbol, they append !. Told to change it every ninety days, they increment the number. The rules did not add unpredictability; they narrowed everyone into the same small set of patterns, which is precisely what attackers exploit.

How passwords are actually attacked

The mental model most people have - an attacker trying aaaa, then aaab, working through every combination - is wrong, and it is why complexity feels more protective than it is. Real attacks proceed in order of expected return.

First, known passwords. Billions of real passwords have leaked from breaches. Attackers try these first, because a password that one human chose is likely to be a password another human chose. This step alone breaks a large fraction of accounts and costs almost nothing.

Second, credential stuffing. Email and password pairs from one breach are replayed against other services. This is how most account takeovers happen, and no amount of complexity helps - the password is already known.

Third, dictionary attacks with mangling rules. Word lists combined with transformation rules: capitalise the first letter, append digits, substitute @ for a, 0 for o, 3 for e, append the current year. Tools such as Hashcat ship with rule sets refined over years against real breach data. P@ssw0rd2026! is not a hard password; it is a rule applied to a dictionary word.

Fourth, patterns. Keyboard walks (qwerty, 1qaz2wsx), dates, names, sports teams, and site names embedded in the password.

Last, and rarely, brute force. Only for short passwords, because the search space grows too quickly otherwise.

The consequence is that a password's strength depends on where it sits in that ordering, not on how complicated it looks.

Entropy belongs to the process, not the string

Entropy measures how many possibilities an attacker must search, in bits. Each bit doubles the work. The subtlety that matters: entropy is a property of how the password was generated, not of the characters in it.

Randall Munroe's much-cited xkcd comic made the point precisely. Tr0ub4dor&3 has about 28 bits of entropy, because it is one common word plus predictable substitutions plus an appended symbol and digit - a small space that cracking rules search directly. correct horse battery staple, four words drawn at random from a list of 2,000, has about 44 bits. It looks simpler and is roughly 65,000 times harder to guess.

The word "random" is doing the work. Four words you chose because they form a memorable phrase are not random - they follow the statistics of English and the associations of your own mind, both of which are modellable. The words must be selected by something that does not think, which is why diceware and password managers exist.

Length is the variable that matters

Adding a character multiplies the search space by the size of the character set. Adding a character set multiplies it once. That asymmetry decides the argument.

Note that twelve lowercase characters beat eight mixed characters comfortably. This is why the modern recommendation is a minimum of twelve to sixteen characters with no composition requirement, and why systems capping password length at ten are a genuine red flag - a length cap usually implies the password is being stored in a fixed-width field rather than hashed.

How the site stores it matters more than your choice

You cannot control this and it dominates the outcome, which is worth understanding when you read about a breach.

Plain text. Nothing you choose helps. It happens more than it should.

Unsalted fast hash - MD5, SHA-1, SHA-256. A modern GPU computes tens of billions of these per second. Common passwords fall instantly; anything under about twelve random characters falls eventually. Unsalted means identical passwords produce identical hashes, so one crack reveals every user who chose it.

Salted slow hash - bcrypt, scrypt, Argon2id. Deliberately expensive to compute, with a unique salt per user. The same hardware manages tens of thousands of guesses per second rather than billions - a factor of roughly a million. This is what competent systems use.

The practical implication for a user is that you should assume the worst. Choose passwords strong enough to survive the fast-hash case, and above all make them unique, so that one site's incompetence does not compromise the rest of your accounts.

What to actually do

1. Use a password manager. This is the entire game. It makes unique passwords for every site possible, which is the single most valuable property. Any reputable manager is dramatically better than reuse.
2. One long passphrase for the manager itself. Six random words, generated rather than chosen. This is the one password you memorise.
3. Let it generate everything else. Sixteen to twenty random characters. You never type them, so memorability is irrelevant.
4. Turn on two-factor authentication, starting with email. An authenticator app or hardware key beats SMS, which is vulnerable to SIM swapping - but SMS still beats nothing by a wide margin.
5. Use passkeys where offered. They remove the password entirely, cannot be phished, and cannot be reused across sites because they are unique by construction.
6. Check your addresses at Have I Been Pwned and change anything that appears.
7. Stop rotating on a schedule. Change a password when there is evidence of compromise. Routine rotation makes passwords predictably worse.

Your email account is the master key

One point worth isolating. Almost every other account can be reset through your email. An attacker with your email does not need any of your other passwords - they can request a reset for each one in turn.

So your email deserves the strongest password you have, the strongest second factor available, and a review of its recovery options. A hardware security key on email is the highest-value security purchase most people can make, and it costs about the same as a nice dinner.

Frequently asked questions

Related tools