Most password advice is stuck in 2005: "use a capital letter, a number, and a symbol." Follow it and you get Password1! — a password a modern cracking rig guesses almost instantly. The rules that actually matter are different, and they come down to one measurable thing: entropy. Once you understand it, building genuinely strong passwords becomes simple.

Strength is measured in bits

A password's real strength is how many guesses an attacker needs, on average, to find it. That's captured by entropy, measured in bits:

Entropy (bits) = length × log₂(size of character set)

Each bit doubles the number of possible passwords. The character set sizes:

  • lowercase only: 26 characters → 4.7 bits each

  • lowercase + uppercase + digits: 62 → 5.95 bits each

  • all printable symbols: 95 → 6.6 bits each

A 12-character password using letters and digits is 12 × 5.95 ≈ 71 bits, meaning about 2⁷¹ ≈ 2.4 sextillion possibilities. Rough rule of thumb: under 50 bits is weak, 70+ is strong, 100+ is overkill for anything but state secrets.

Why length beats complexity

Here's the counterintuitive part. Compare two passwords:

  • X7#kQ — five random characters from the full symbol set: 5 × 6.6 ≈ 33 bits. Painful to type, painful to remember, and weak.

  • correct-horse-battery-staple — four random common words: with a 7,776-word list that's 4 × 12.9 ≈ 52 bits. Easy to remember, and stronger.

Adding one more word beats adding symbols every time, because each word contributes far more entropy than one character does. Length is the single biggest lever. A long passphrase of random words is both more memorable and harder to crack than a short jumble of symbols — which is why modern guidance (including NIST's) now favours length over forced complexity.

How attackers actually crack passwords

They don't guess randomly. Three techniques dominate:

  • Dictionary and rule attacks try common words and predictable substitutions first — Password1!, P@ssw0rd, your pet's name plus a year. Anything human-chosen is vulnerable here.

  • Brute force tries every combination, which is where entropy is your defence. At a trillion guesses a second, 71 bits still takes millions of years; 35 bits falls in seconds.

  • Credential stuffing skips cracking entirely: attackers take passwords leaked from one breached site and try them everywhere else. This is why reuse is the deadliest mistake — one breach compromises every account sharing that password.

The four rules that matter

  1. Make it long. Aim for 16+ characters, or a 5-word-plus random passphrase. Length first, always.

  2. Make it random. Human-chosen passwords cluster around predictable patterns. Generate them instead — the password generator produces high-entropy strings and passphrases and shows the strength as you adjust the length.

  3. Never reuse. A unique password per account contains the damage of any single breach. A password manager makes this effortless.

  4. Add a second factor. Two-factor authentication means a stolen password alone isn't enough — the most valuable single upgrade you can make.

For developers: store them properly

If you build software, strength on the user's side is only half the job. Never store raw passwords — store a salted hash. You can see how a hashing function turns any input into a fixed fingerprint with the hash generator (SHA-256 and friends), and when you need unique, unguessable identifiers for tokens or reset links, the UUID generator produces them. Hashing plus per-user salts is what stops a database leak from becoming an instant password dump.

The bottom line

Forget the old symbol-and-number ritual. Strength is entropy, entropy scales fastest with length, and the winning formula is long, random, unique, plus 2FA. Generate your next password with the password generator instead of inventing one — humans are terrible random number generators — and stop reusing the ones you have. A few minutes of setup buys you the kind of security that no clever ! at the end ever could.