Most password advice is a decade out of date. The rules many organisations still enforce — one uppercase, one number, one symbol, changed every ninety days — were formalised in a 2003 US government publication whose own author later said he got it wrong. The current guidance is simpler, easier to follow, and produces genuinely stronger passwords. This is what actually matters.
Entropy, without the maths degree
Password strength is measured in bits of entropy. It answers one question: how many guesses would an attacker need, on average, to find this password by brute force?
Each additional bit doubles that number. A 40-bit password takes about a trillion guesses; 41 bits takes two trillion. The formula is:
entropy = length × log₂(size of the character pool)
The character pool is how many distinct characters could appear in each position. Lowercase letters alone give 26. Adding uppercase gives 52. Adding digits gives 62. Adding common symbols gives roughly 95.
Each lowercase-only character therefore contributes about 4.7 bits, while each character drawn from the full 95-character set contributes about 6.6 bits. That is the entire trade-off: adding symbols increases the value of each character by about 40%, whereas adding characters increases entropy linearly with no ceiling.
What the numbers mean in practice
| Entropy | Assessment |
|---|---|
| Under 40 bits | Trivially crackable — offline attack succeeds in seconds |
| 40–55 bits | Weak; adequate only where rate-limiting is enforced |
| 56–70 bits | Reasonable for low-value accounts |
| 71–90 bits | Strong — suitable for email, banking, primary accounts |
| Over 90 bits | Infeasible to brute-force with foreseeable hardware |
Why length beats complexity
Compare two passwords that look very different in perceived strength.
P@ssw0rd! is nine characters from the full 95-character set, which is about 59 bits on paper. In reality it is far weaker, because it is a dictionary word with predictable substitutions — exactly the transformation every cracking tool applies first. Its effective strength is closer to 20 bits, and it appears in every breached-password list in existence.
correcthorsebatterystaple is 25 lowercase characters. Even assuming the attacker knows it is four common English words, there are roughly 7,776⁴ combinations if drawn from a standard 7,776-word list — about 51 bits. Extend to five or six words and you are past 64 and 77 bits respectively, while the password remains memorable.
The general rule: every character you add multiplies the search space, while adding a symbol only widens it slightly. Length is the lever that scales.
What current guidance actually says
NIST Special Publication 800-63B revised the standard advice substantially. The headline changes:
- Stop forcing periodic rotation. Mandatory 90-day changes push people toward predictable variations —
Spring2026!becomesSummer2026!— which is weaker than one strong password kept indefinitely. Change a password when there is a reason to: a breach, a suspected compromise, or reuse. - Drop composition rules. Requiring a symbol and a digit predictably produces a capital at the start and a
1!at the end. It adds almost no real entropy while measurably harming usability. - Screen against breach lists instead. Checking a proposed password against known-compromised passwords does far more for security than any composition rule.
- Allow long passwords and all characters. Minimum eight, support at least 64, accept spaces and Unicode.
Practical recommendations
Use a password manager for almost everything
The single highest-impact change available. A manager lets every account have a long, fully random, unique password that you never need to recall. Reuse — not weakness — is what actually compromises most accounts: attackers take credentials from one breached site and try them everywhere else, an attack called credential stuffing. Unique passwords make it structurally impossible.
Generate them at 16 characters minimum, 20 or more for anything important. The password generator produces them using the browser's cryptographic random source and shows the resulting entropy.
Use a passphrase for the handful you must memorise
Your password manager's master password, your device login, and your primary email cannot live inside the manager. For these, use a passphrase of five or six unrelated words. Choose them randomly — words you pick yourself cluster around a much smaller set than you would expect, and a phrase from a song or film is already in the wordlists.
Turn on two-factor authentication
2FA protects an account even when the password is fully compromised, so it does more for real-world security than any amount of extra password entropy. An authenticator app or hardware key is meaningfully stronger than SMS, which is vulnerable to SIM-swap attacks — but SMS 2FA is still far better than none.
Consider passkeys where offered
Passkeys replace the password with a cryptographic key pair held by your device. The private key never leaves it and nothing reusable is transmitted, which makes them resistant to both phishing and breaches. Adoption is still uneven, so passwords are not going away yet, but enable passkeys wherever a service supports them.
Common misconceptions
“Substituting @ for a and 0 for O makes a word strong.” It does not. These substitutions are the first rule every cracking tool applies, and they cost an attacker essentially nothing.
“Nobody would target me.” Credential stuffing is automated and indiscriminate. Nobody is targeting you specifically; a script is trying millions of leaked pairs against hundreds of sites.
“A password-strength meter proves it is safe.” Most meters score composition rules rather than real resistance to attack, which is why P@ssw0rd1!often scores “strong”. Treat any meter that ignores dictionary matching as decorative.
“Writing passwords down is always bad.”Context matters. A notebook in a locked drawer at home is a reasonable defence against remote attackers, who are the realistic threat for most people. A sticky note on a monitor in an open office is not.
The short version
- Length matters more than special characters.
- Uniqueness matters more than either.
- A password manager solves both at once.
- Use a random 5–6 word passphrase for the few you must memorise.
- Enable 2FA everywhere it is offered.
- Change passwords on evidence of compromise, not on a calendar.