Strong Passwords: Why Length Beats Complexity Every Time
Decades of 'must contain a capital, a number and a symbol' rules trained everyone to write passwords like P@ssw0rd1! — which modern cracking rigs chew through in minutes. The mathematics of password strength says something different and simpler: length dominates everything else. Here is why, with the actual numbers. 01 . Entropy: the only score that matters A password's strength is its entropy — the number of guesses an attacker needs in the worst case, computed as (alphabet size)^(length). Adding symbols grows the base of that power; adding characters grows the exponent. Exponents win. An 8-character password using all 95 keyboard symbols offers about 6.6 quadrillion combinations; a 16-character password using only lowercase letters offers over 43 sextillion — thousands of times more, with half the typing frustration. 02 . What modern hardware does to short passwords A single consumer GPU rig can test on the order of hundreds of billions of guesses per second against weakly-hashed leaks. At that speed, any 8-character password — regardless of symbols — falls within hours to days. Every character you add multiplies the attacker's work by the alphabet size: the jump from 8 to 12 characters turns hours into centuries, and 16 characters puts brute force beyond any plausible hardware. 03 . Rules that actually improve security First, never reuse a password across sites — credential-stuffing attacks replay leaked pairs everywhere, and reuse converts one breach into all of them. Second, prefer 16+ characters, generated randomly or built as a four-plus word passphrase. Third, let a password manager remember them; the human brain is for the one master passphrase. Finally, enable two-factor authentication on email and banking — it survives even a leaked password. What does not help much: forced 90-day rotations (users respond with Password2, Password3), obligatory symbols in short strings, and 'security questions' whose answers sit on your social media profile. Takeaway: Make passwords long before you make them fancy: 16 random characters or a four-word passphrase, unique per site, stored in a manager, backed by two-factor auth. That combination defeats every attack that does not involve a wrench.