What Actually Makes a Password Strong (Hint: Not the Exclamation Mark)
Password rules taught a generation to produce exactly the wrong thing. "At least one capital, one number and one symbol" reliably yields Password1! — a password that satisfies every rule and appears near the top of every cracking dictionary. Strength comes from unpredictability, and unpredictability is measurable.
Entropy is the only honest measure
Entropy counts how many guesses an attacker would need, expressed in bits, where each additional bit doubles the work. It depends on the size of the character pool and the length of the password — but only if the password was generated randomly.
That caveat is the entire subject. A 12-character password drawn randomly from 94 printable characters carries about 79 bits. A 12-character password you invented carries far less, because human choices cluster heavily: a capital at the start, a digit at the end, a dictionary word in the middle. Cracking tools model those habits directly, so the theoretical pool never applies.
The password strength checker calculates entropy from the actual character space and then penalises the patterns attackers exploit first, which is why a password that looks complex can still score poorly.
Length beats complexity, decisively
Adding a character multiplies the search space by the size of the pool. Adding a character class only widens the pool once.
A 20-character all-lowercase password has roughly 94 bits of entropy. An 8-character password using every class has about 52. The longer, simpler one is around eighteen billion times harder to brute force. This is why modern guidance from bodies including NIST dropped composition rules in favour of length and screening against known-breached passwords.
Practical floor: 16 random characters for anything that matters, generated rather than invented. The password generator uses the browser's cryptographic random source and reports the resulting entropy, so strength is a number rather than a colour bar.
Passphrases, done correctly
Four or five words selected at random from a large word list produce high entropy and remain memorable. Six words from a 7,776-word list gives about 77 bits — comparable to a 12-character random string and far easier to type on a phone.
The word "random" is doing the work. Choosing a phrase yourself, a song lyric, or words that form a sentence collapses the entropy, because the relationships between words are predictable. The words must be drawn by a random process, not by you. Reserve passphrases for the few credentials you must type from memory — your device login and your password manager — and let the manager generate random strings for everything else.
Why reuse is the bigger risk
Most accounts are not compromised by brute force. They are compromised because a password leaked from one service was tried on another, an attack that works instantly regardless of how strong the password is. A unique 60-bit password on every site is safer in practice than the same 100-bit password everywhere.
This is the argument for a password manager that reduces the problem to one strong passphrase plus multifactor authentication. Where it is offered, an app-based or hardware authenticator is meaningfully stronger than SMS, which is vulnerable to SIM-swap attacks.
Storing passwords, if you are the developer
If you are on the receiving end of this, the requirements invert: you need hashing that is deliberately slow. Use bcrypt, scrypt or Argon2 with a unique per-user salt.
Fast general-purpose hashes are the wrong tool precisely because they are fast — the same speed that makes SHA-256 excellent for checksums lets an attacker test billions of candidates per second against a stolen table. A SHA-256 and SHA-512 generator is the right instrument for verifying file integrity and comparing digests, and the wrong one for storing credentials. Screen new passwords against a breached-password list, rate-limit attempts, and do not force periodic rotation without cause, since that pushes people toward predictable variations.