How Strong Should a Password Be? Length vs. Complexity

Understanding password strength begins with recognizing that it's all about the number of possible guesses an attacker would need to make. Every additional character added to a password exponentially increases this number, which is why length is far more crucial than substituting characters like swapping an "a" for an "@" symbol.

The key concept here is entropy, which measures how unpredictable a password is in bits. For a password chosen randomly from a pool of characters, each additional bit effectively doubles the number of guesses required to crack it.

To calculate a password's entropy, simply multiply its length by the base-2 logarithm of the total number of characters in the pool. For instance, using a typical set of 94 printable ASCII characters, an 8-character random password offers around 52 bits of entropy, while a 12-character password reaches approximately 79 bits, and a 16-character password provides about 105 bits of entropy. Even a 20-character password reaches around 131 bits of entropy.

However, these figures are based on the assumption of truly random passwords. Passwords created by humans tend to be much weaker than their length might suggest. Attackers typically don't try passwords in a straightforward sequence. Instead, they often start with leaked password lists, common words, keyboard patterns, names, dates of birth, and predictable substitutions (like P@ssw0rd!).

Even a password like "Summer2026!" might appear complex, but it follows a pattern that attackers try early on, making its actual strength quite low.

One effective way to balance security and memorability is through the use of passphrases - long sentences composed of several unrelated, random words. These are easier to remember than traditional passwords while still offering strong security. Choosing words at random, for example using a dice or an online generator, rather than selecting words that feel meaningful, is essential.

For example, a passphrase made up of five random words from a 7,776-word list offers roughly 65 bits of entropy, while a six-word passphrase provides about 78 bits of entropy.

A straightforward approach to managing passwords is to use a password manager. This tool can generate unique, random passwords of 16 or more characters for each account. Only two passwords need to be memorized with this method: the master password for the password manager and the password for the device itself. For the few passwords that must be remembered manually, a random passphrase consisting of five or six words is recommended.

It's also crucial to avoid reusing passwords, as a breach of one account can compromise all reused passwords. Enabling two-factor authentication (2FA) wherever possible, preferably via an authenticator app or hardware key, adds an extra layer of security. Passwords should be changed only after a breach, sharing, or suspicion, not on a fixed schedule.

It's important to remember that modern guidance, such as that from NIST, now favors length over complex composition rules and discourages the requirement to change passwords regularly. Sites that limit password length or forbid certain characters actually work against users. A password manager can help users work around these limitations.

When checking the strength of a password, never paste it into a checker that sends it to a server. Use a checker that operates entirely in your browser, and assume that any password you've pasted into an untrusted site might be compromised.

Frequently asked questions:

How long should a password be in 2026? For accounts protected by a password manager, aim for 16 or more random characters. For a memorized passphrase, five or six random words should suffice.

Are passphrases more secure than passwords? A random passphrase made up of a sufficient number of words can be as secure, if not more so, than a random character password, while being much easier to remember and type.

Do special characters make a password stronger? They can add some complexity, but length adds significantly more strength. A longer password without special characters is generally stronger than a short one with symbols, especially if the symbols follow predictable patterns.

Should I change my passwords regularly? Not on a fixed schedule. Change your passwords only after a breach or suspicious activity, and always use unique passwords in combination with two-factor authentication for added security.