What Makes a Password Strong? Length vs Complexity

For years we were told a strong password needs an uppercase letter, a number and a symbol. So we created passwords like Rahul@1990 — and attackers’ software learned to guess exactly those patterns. Today, security experts agree: length and randomness matter far more than a sprinkle of symbols.

How passwords actually get cracked

When a website is breached, attackers often steal a database of password hashes — scrambled versions of passwords. They then use powerful computers to guess passwords at enormous speed, hashing each guess and comparing it to the stolen list.

They don’t guess randomly. They try:

1. Leaked passwords from earlier breaches (millions of real passwords).
2. Dictionary words and names, plus common variations: capital first letter, a year or “123” at the end, @ for a, 0 for o.
3. Brute force — every possible combination — only as a last resort.

So Rahul@1990 falls quickly: it’s a name, a symbol and a year — a pattern cracking tools try very early.

Why length wins: the maths

Strength can be measured in bits of entropy — roughly, how many guesses a random password would take. Each extra bit doubles the work.

Entropy = Length × log₂(number of possible characters)

Assuming an attacker can make about 10 billion guesses per second against a fast hash, a truly random password would hold out roughly this long:

Notice how going from 8 to 12 characters does far more than adding symbols to an 8-character password. Length grows the number of possibilities exponentially.

Passphrases: long and memorable

Four or five random words, like lamp-river-cotton-orbit, create a long password that’s easier to remember and type than k#9Lq!2x. The key word is random — let a generator or dice pick them, not your favourite movie quote.

The bigger risk: reusing passwords

Even a perfect password is useless if you use it everywhere. When one small website gets hacked, attackers try the same email and password on Gmail, banking apps, Instagram and Amazon. This is called credential stuffing, and it’s one of the most common ways accounts are taken over.

Use a different password for every account. That’s only practical with…

Password managers

A password manager stores all your passwords in an encrypted vault, protected by one strong master password. It can generate long random passwords and fill them in for you. Good options are built into browsers and phones, and there are dedicated apps too. You remember one long passphrase; the manager remembers the rest.

Turn on two-factor authentication (2FA)

2FA adds a second step — a code from an authenticator app, a prompt on your phone, or a security key — so a stolen password alone isn’t enough. Prioritise it for:

• Your email (it can reset every other password)
• Banking and UPI apps
• Social media and work accounts

A simple checklist

• ✅ At least 12–16 characters, random or a random passphrase
• ✅ A unique password for every account
• ✅ Stored in a password manager
• ✅ 2FA on email, banking and social media
• ✅ Change a password immediately if a service you use reports a breach

Generate one now

Our Password Generator uses your browser’s cryptographically secure random generator to create passwords of any length, with options for numbers, symbols and avoiding look-alike characters. It shows the strength in bits, and nothing is ever sent or stored.

Written by the Toolsopedia team. Spotted an error? Tell us and we’ll fix it.