Some passwords look strong and aren't. Tr0ub4dor&3 has 11 characters, an uppercase letter, a digit, and a symbol — yet crackers love it. Meanwhile correct horse battery staple is 28 characters of lowercase words and is vastly harder to guess. The difference is entropy.
What is password entropy?
Entropy measures unpredictability, in bits. Every bit doubles the number of possible passwords an attacker must try. The formula is simple:
entropy = length × log₂(charset size)
- Lowercase letters (26): 4.7 bits per character
- + Uppercase (52): 5.7 bits
- + Digits (62): 6.0 bits
- + Symbols (~95): 6.6 bits
The charset matters — but only a little. Going from lowercase-only to full symbols buys you under 2 extra bits per character. Adding one character to a lowercase-only password buys you 4.7 bits. That's the whole argument in one sentence: length beats complexity, roughly two and a half times over.
Let's do the math
-
Tr0ub4dor&3(11 chars, 4 charsets): 11 × 6.6 ≈ 73 bits -
correcthorsebatterystaple(25 chars, lowercase): 25 × 4.7 ≈ 118 bits
The lowercase passphrase has more than 2⁴⁵ times the combinations. This is why modern guidelines (NIST SP 800-63B included) emphasize length over forced complexity.
Practical takeaways
- Use 16+ characters. At 16 random characters you're past 90 bits — beyond practical brute force.
-
Let a generator do the work. Humans pick
Password1!; CSPRNGs don't. - Unique per site. A 100-bit password is worthless if it's reused.
- Respect site limits. If a site caps length or bans symbols, longer lowercase-only is still strong — just don't shrink a good password to 8 characters.
I generate all my passwords with a local tool: the CodeToolbox Password Generator runs entirely in the browser via crypto.getRandomValues(), so nothing ever leaves my machine. No signup, no upload — just generate and drop the result into your password manager.
Length beats complexity. Always.
Top comments (0)