Password security: length, entropy, and why random beats clever
Most password advice is folklore. The math is simpler than the myths: strength is about unpredictability, which comes from length and randomness — not from swapping an "a" for an "@".
Entropy is the real measure
Password strength is entropy — how many guesses an attacker needs on average. It depends on the size of the character set and the length, but only if the password is actually random. P@ssw0rd! looks complex but is in every cracking dictionary, so its real entropy is near zero.
Generate genuinely random passwords (and see the character-set trade-offs) in the Password Generator.
Length beats complexity
Adding length increases entropy far faster than adding symbol types. A long random password — or a multi-word passphrase — beats a short "complex" one every time. Modern guidance (NIST) favors longer passwords and drops forced composition rules.
The rules that actually matter
- Use a unique password for every site — reuse is how one breach becomes many.
- Use a password manager so length and uniqueness cost nothing.
- Turn on two-factor authentication where offered.
- Prefer long random strings or passphrases over memorable patterns.
How sites should store them
Your password should never be stored as plain text or a fast hash. A responsible site stores it with a slow, salted algorithm like bcrypt or Argon2 — see the hashing guide for why fast hashes are dangerous.
Frequently asked questions
- Is a longer password or a more complex one stronger?
- Length wins. Each extra character multiplies the search space far more than adding symbol types, provided the password is random rather than a predictable pattern.
- Are passphrases as secure as random passwords?
- A long passphrase of several random words can have plenty of entropy and is easier to type and remember. The key is that the words are chosen randomly, not from a familiar phrase.
- Why is password reuse so dangerous?
- When one site is breached, attackers try the same email/password on other sites (credential stuffing). Unique passwords contain the damage to a single account.
- Does swapping letters for symbols (P@ssw0rd) help?
- Barely. Cracking tools know these substitutions. Real strength comes from randomness and length, not predictable character swaps.
Try it yourself
Put this guide into practice — these tools run free in your browser.