Password strength is really a question of how many guesses an attacker would need. Every extra character multiplies that number, which is why length matters far more than swapping an a for an @. Understanding this lets you stop memorizing rules and start choosing passwords that hold up.
Entropy: the number behind strength
Entropy measures unpredictability in bits; each extra bit doubles the number of guesses needed. For a password picked uniformly at random from a set of characters, entropy is length multiplied by log2 of the set size. A random character from the roughly 94 printable ASCII characters adds about 6.5 bits.
- 8 random characters is about 52 bits.
- 12 random characters is about 79 bits.
- 16 random characters is about 105 bits.
- 20 random characters is about 131 bits.
These figures only apply to genuinely random passwords. Human-chosen ones are far weaker than their length suggests.
Why clever tricks don't help much
Attackers don't try every combination in order. They start with leaked-password lists, common words, keyboard patterns, names, dates, and predictable substitutions (P@ssw0rd!). A password like Summer2026! looks complex, but it follows a pattern crackers try early, so its real strength is low.
Passphrases: long and memorable
A passphrase made of several random, unrelated words is easier to remember and can be very strong. The catch is that the words must be chosen randomly (for example with dice or a generator), not picked because they feel meaningful. Each word from a 7,776-word list adds about 12.9 bits, so five words is roughly 65 bits and six is roughly 78 bits.
A simple set of rules that works
- Use a password manager and let it generate a unique random password of 16+ characters for every account.
- For the few passwords you must remember (the manager itself, your device), use a random passphrase of five or six words.
- Never reuse passwords. Reuse is how one breach turns into ten.
- Turn on two-factor authentication wherever it's offered, preferably with an authenticator app or a hardware key.
- Change a password when you have a reason to (a breach, sharing, suspicion), not on a fixed schedule.
What about length limits and special characters?
Modern guidance (such as NIST's) favors length over composition rules and discourages forced periodic changes. Sites that cap passwords at short lengths or forbid certain characters are working against you; a password manager helps you work around them.
Check strength privately
Don't paste real passwords into a checker that sends them to a server. Use one that runs entirely in your browser, and assume any password you've pasted into an untrusted site is compromised.
Frequently asked questions
How long should a password be in 2026?
For accounts protected by a manager, 16 or more random characters. For a memorized passphrase, five or six random words.
Are passphrases more secure than passwords?
A random passphrase of enough words can be as strong as a random character password while being much easier to remember and type.
Do special characters make a password stronger?
A bit, but length adds much more. A longer password beats a short one with symbols, especially if the symbols follow predictable patterns.
Should I change my passwords regularly?
Not on a fixed schedule. Change them after a breach or suspicious activity, and use unique passwords with two-factor authentication instead.
Try it: Password Strength Checker — free, runs in your browser, nothing is uploaded.
Originally published at ilovekit.app.
Top comments (0)