Why Most Password Advice Has Missed the Point
For years, the standard advice was to make passwords complex: uppercase, lowercase, a number, a symbol. The result was a generation of passwords like P@ssw0rd1! — technically meeting the rules, but trivially easy for modern cracking tools to guess because these patterns are so predictable.
In 2017, the National Institute of Standards and Technology (NIST) updated its digital identity guidelines to reflect what security researchers already knew: length matters far more than character complexity. A 20-character password made up of common words is stronger than an 8-character jumble of symbols. Automated cracking tools can process billions of guesses per second, but the sheer number of possible long passwords makes brute-force attacks impractical.
The takeaway: stop optimizing for appearance and start optimizing for length and unpredictability.
What Actually Makes a Password Hard to Crack
Three properties determine real password strength:
- Length: Every added character multiplies the possible combinations exponentially. A 12-character password has roughly 3 trillion times more combinations than an 8-character one using the same character set.
- Randomness: The characters or words must have no predictable pattern. Personal details — names, birthdays, sports teams — are among the first things attackers try. So are common substitutions like
3foreor@fora. - Uniqueness: Using the same password across accounts means one breach exposes all of them. A credential stuffing attack — where leaked passwords are automatically tried on other sites — is one of the most common account takeover methods today.
Use a Password Manager for Every Account
You don't need to memorize dozens of unique, random passwords. A password manager generates and stores them for you, requiring only one strong master password to access everything. This is the most practical way to follow strong password principles across all your accounts.
If creating and remembering a unique, long password for every account sounds impossible, that's because it genuinely is without help. That's exactly what password managers are designed for — see our beginner's guide to password managers for how to get started.
Passphrases: Long, Random, and Actually Usable
A practical approach that balances strength and memorability is the random passphrase: four or more unrelated words strung together, ideally chosen by a random generator rather than by you. Something like orange-ladder-comet-fence is long, has high entropy, and is far easier to recall than Xk#9mQ!2.
The critical word is random. A phrase you construct from something meaningful — a song lyric, a pet's name plus a lucky number — is much more guessable than it looks, because humans are predictable. Tools like EFF's online dice-based word list generator are specifically designed to produce genuinely random word combinations.
For accounts where you need to type a password regularly and can't use a manager, a random passphrase is your best practical option.
Password Strength in Practice
Applying these principles across all your accounts is the real challenge. A few practical priorities:
- Start with your most important accounts. Email and bank accounts deserve the strongest, most unique passwords first — they're gateway accounts that can unlock everything else.
- Don't rely on periodic resets. Changing passwords on a schedule without cause tends to produce weaker versions of the same password. Change a password when there's a reason — a breach notification, a shared device, or a compromised service.
- Enable two-factor authentication wherever possible. Even a strong password can be leaked in a data breach. Two-factor authentication adds a second verification step that significantly limits what an attacker can do with your password alone.
- Check for breaches. Services like Have I Been Pwned (haveibeenpwned.com) let you check whether your email address appears in known data breaches, so you know when to act.
Strong password habits are one piece of a larger security picture. For a broader look at the daily practices that protect you online, see the habits that keep everyday users secure.
Frequently Asked Questions
Security experts generally recommend at least 16 characters for most accounts. Longer is better — each additional character dramatically increases the number of possible combinations an attacker must try. For high-value accounts like email or banking, aim for 20 or more characters.
A passphrase made of four or more unrelated random words (such as 'carpet-lantern-bicycle-fog') can be just as secure as a shorter complex password, while being far easier to remember. The key is that the words must be genuinely random, not a meaningful phrase someone who knows you could guess.
They help, but only marginally compared to length. A long password without special characters is often stronger than a short one with them. Using special characters in predictable spots — like an exclamation mark at the end — adds very little real protection.
Current guidance from security bodies like NIST no longer recommends routine forced password changes, which often result in weaker passwords. Change a password immediately if you know or suspect it has been compromised — not on an arbitrary schedule.
Passwords are weak when they follow predictable patterns — dictionary words with letter substitutions, keyboard walks like 'qwerty123', or personal information like birthdates. Attackers use extensive lists of these patterns as their starting point in automated attacks.
No. Reusing passwords — even strong ones — is one of the most common ways accounts get compromised. If one site is breached and your password is exposed, attackers will try that same credential on hundreds of other sites automatically.
The content on this site is for informational purposes only and is not a substitute for professional advice. Always consult a qualified professional for guidance specific to your situation.