What Actually Makes a Password Strong?
Most people add a capital letter and an exclamation mark and think their password is secure. It is not. Password strength comes down to two things: length and randomness. Length matters more than anything else.
Test your current password: Password Strength Checker →
Understanding Password Entropy
Entropy is the measure of password unpredictability, expressed in bits. Each additional bit doubles the number of possible combinations an attacker must try.
| Password | Entropy | Crack Time (GPU) |
|---|---|---|
| password | ~6 bits | Instant |
| Password1! | ~35 bits | Minutes |
| Tr0ub4dor&3 | ~44 bits | Days |
| correct-horse-battery-staple | ~44 bits | Days |
| Kx9#mP2$vL8!nQ4w | ~100 bits | Billions of years |
How Attackers Crack Passwords
Dictionary Attacks
Attackers start with common words, names, and phrases — including "clever" substitutions like p@ssw0rd. If your password is based on a word, it is vulnerable.
Brute Force
Trying every possible combination. A modern GPU can test 100 billion 8-character passwords per second. An 8-character password with mixed case and symbols falls in hours.
Credential Stuffing
Using passwords leaked from other breaches. If you reuse passwords, one breach exposes every account. Check your email at our Email Breach Checker.
The Rules for an Uncrackable Password
- 16+ characters minimum — Length is the single biggest factor. 16 characters beats 8 characters with every trick combined.
- Truly random — Not based on words, names, dates, or patterns. Use our Password Generator for truly random passwords.
- All character types — Uppercase, lowercase, numbers, and symbols expand the character pool from 26 to 94 characters.
- Unique per site — One breach should not expose all your accounts. Use a password manager.
- No personal information — Attackers try your name, birthday, pet name, and city first.
Password Length vs Complexity
A 20-character lowercase-only random password is stronger than a 10-character password with all character types. Length wins. Add complexity too for maximum security but never sacrifice length for it.
Related Tools
- Password Generator — Generate cryptographically random passwords instantly
- Email Breach Checker — See if your email and passwords were leaked
- Password Strength Checker — Test any password before using it
