How Strong Should a Password Be? Length vs. Complexity

Password strength is really a question of how many guesses an attacker would need. Every extra character multiplies that number, which is why length matters far more than swapping an a for an @. Understanding this lets you stop memorizing rules and start choosing passwords that hold up.

Entropy: the number behind strength

Entropy measures unpredictability in bits; each extra bit doubles the number of guesses needed. For a password picked uniformly at random from a set of characters, entropy is length multiplied by log2 of the set size. A random character from the roughly 94 printable ASCII characters adds about 6.5 bits.

• 8 random characters is about 52 bits.
• 12 random characters is about 79 bits.
• 16 random characters is about 105 bits.
• 20 random characters is about 131 bits.

These figures only apply to genuinely random passwords. Human-chosen ones are far weaker than their length suggests.

Why clever tricks don't help much

Attackers don't try every combination in order. They start with leaked-password lists, common words, keyboard patterns, names, dates, and predictable substitutions (P@ssw0rd!). A password like Summer2026! looks complex, but it follows a pattern crackers try early, so its real strength is low.

Passphrases: long and memorable

A passphrase made of several random, unrelated words is easier to remember and can be very strong. The catch is that the words must be chosen randomly (for example with dice or a generator), not picked because they feel meaningful. Each word from a 7,776-word list adds about 12.9 bits, so five words is roughly 65 bits and six is roughly 78 bits.

A simple set of rules that works

1. 1Use a password manager and let it generate a unique random password of 16+ characters for every account.
2. 2For the few passwords you must remember (the manager itself, your device), use a random passphrase of five or six words.
3. 3Never reuse passwords. Reuse is how one breach turns into ten.
4. 4Turn on two-factor authentication wherever it's offered, preferably with an authenticator app or a hardware key.
5. 5Change a password when you have a reason to (a breach, sharing, suspicion), not on a fixed schedule.

What about length limits and special characters?

Modern guidance (such as NIST's) favors length over composition rules and discourages forced periodic changes. Sites that cap passwords at short lengths or forbid certain characters are working against you; a password manager helps you work around them.