Most password advice is outdated. "Use uppercase, lowercase, numbers, and symbols" sounds reasonable but leads to passwords like P@ssw0rd! — technically complex but easily cracked. Modern password security is based on very different principles. This guide explains what actually makes a password strong.
What Makes a Password Strong
Password strength comes from entropy — the amount of randomness in the password, measured in bits. Higher entropy means more possible combinations an attacker must try. The key factors:
- Length is king: Each additional character exponentially increases the number of possible combinations. A 16-character password has roughly 10 billion times more combinations than an 8-character password with the same character set
- Randomness matters more than complexity:
correcthorsebatterystaple(4 random words) has more entropy thanP@ssw0rd!(a predictable substitution pattern) - Unpredictability is essential: Dictionary words, names, dates, keyboard patterns (qwerty, 12345), and l33t substitutions are all in cracking dictionaries
How Attackers Crack Passwords
Brute Force
Try every possible combination. An 8-character password using all character types (uppercase, lowercase, digits, symbols — 95 possibilities per character) has 95^8 = ~6.6 quadrillion combinations. Sounds like a lot, but a modern GPU can test billions of hashes per second against weak hash algorithms.
Dictionary Attacks
Try common passwords and words from dictionaries. "password123", "qwerty", "iloveyou", and millions of others are tested first. These crack instantly regardless of hash strength.
Credential Stuffing
Use passwords leaked from other breaches. If you reuse passwords, a breach at one service compromises all your accounts. This is why unique passwords per site is the most important rule.
Pattern-Based Attacks
Attackers know humans use predictable patterns: capital first letter, numbers at the end, @ for "a", 0 for "o". Cracking tools like Hashcat have rules specifically for these patterns.
The Passphrase Approach
Instead of a random string of characters, use a passphrase — multiple random words strung together:
correct horse battery staple
purple elephant dancing moonlight
quantum pretzel umbrella telescopeA 4-word passphrase from a 7,776-word list (like the EFF Diceware list) has about 51 bits of entropy — comparable to a random 10-character mixed-case password but far easier to remember. A 5-word passphrase reaches 64 bits, and 6 words gets you to 77 bits (effectively uncrackable by brute force).
The critical rule: the words must be truly random, not a phrase that makes sense. "I love my dog" is not a strong passphrase. "Correct horse battery staple" works because the words are randomly selected.
Password Managers: The Real Answer
The best password strategy is simple: use a password manager and let it generate a unique, random 20+ character password for every account. You remember one master password (make it a strong passphrase), and the manager handles everything else.
Leading options: Bitwarden (free/open-source), 1Password, and KeePass (offline/local). All generate, store, and auto-fill passwords across devices.
With a password manager, the question isn't "how do I create a strong password I can remember" — it's "how do I create a strong master password" (the only one you need to remember).
Common Mistakes
- Reusing passwords: The #1 mistake. One breach compromises everything. Use unique passwords everywhere
- Predictable substitutions: "p@ssw0rd" is not clever. Cracking tools know all the l33t-speak substitutions
- Adding "1!" to meet requirements: Complexity requirements that lead to "Password1!" create a false sense of security
- Using personal information: Pet names, birthdays, addresses, and children's names are social engineering targets
- Rotating passwords on a schedule: Forced password changes lead to weaker passwords (users increment a number). Only change passwords when compromised. NIST updated their guidelines to reflect this
- Security questions: "What's your mother's maiden name?" is publicly discoverable. Use random answers stored in your password manager
How Passwords Should Be Stored
You create a strong password — but does the website store it safely? Responsible services hash passwords with algorithms like bcrypt, scrypt, or Argon2. These are intentionally slow, making brute-force attacks impractical even if the hash database is stolen.
Explore how hashing works with our Hash Generator and Bcrypt Generator.
Check Your Password Strength
Curious how strong your current passwords are? Our Password Strength Checker analyzes entropy, pattern detection, dictionary matches, and estimated crack time — all locally in your browser. Your password never leaves your device.