How to Create Strong Passwords: Length and Complexity

Why Password Length Matters More Than You Think

Length is the single most important factor in password strength. A 16-character password made of lowercase letters takes orders of magnitude longer to brute-force than an 8-character password with symbols. Every extra character multiplies the search space by the size of the character pool, so strength grows exponentially with length rather than linearly.

Most people underestimate how fast modern hardware cracks short passwords. A single high-end consumer GPU can test over a hundred billion guesses per second against fast hashes such as MD5 (slow hashes like bcrypt are far harder). Against a fast hash, an 8-character password, even a complex one, can fall in hours. A random 16-character password would take centuries, even in all lowercase. Start there.

Complexity Helps, But Not the Way You Expect

Adding uppercase letters, numbers, and symbols expands the character pool, which raises the theoretical difficulty of a brute-force attack. The practical benefit depends entirely on whether your characters are distributed randomly. Substituting 'a' with '@' or adding a '1' to a word does almost nothing; cracking tools apply those rules automatically.

True complexity means each character is independently random. 'Tr0ub4dor&3' is not random: it is a dictionary word with predictable substitutions. 'k9#Lm2!vQzXs' is closer. The difference is whether a human or an algorithm chose the characters. If you chose them, they are probably patterned.

Passphrases Are Long Passwords That Are Actually Usable

A passphrase strings together four or more random common words: 'correct horse battery staple' from xkcd is the famous example. That is 25 characters, not counting spaces, and easy to remember. The randomness comes from the word selection, not the words themselves, so picking words you like defeats the purpose. A bigger word list helps too: each word from EFF's 7,776-word list adds about 12.9 bits. Our passphrase generator shows the format, but it uses a few hundred words and Math.random(), which is not secure, so create real master passphrases in your password manager or with dice.

Passphrases work best for master passwords, device logins, and anything you need to type regularly. For accounts managed by a password manager, fully random strings from the manager or a password generator are fine because you never type them anyway. Match the format to the use case.

Common Mistakes That Undermine Good Intentions

Reusing passwords across accounts is the single biggest practical risk. One breach exposes every account that shares the password. The solution is not a better shared password; it is using a different password everywhere, which in practice makes a password manager essential.

Other common failures: using personal information like birthdays or pet names, meeting minimum requirements exactly rather than exceeding them, and storing passwords in a plain text file or browser without a master password. Each of these trades security for convenience in a way that attackers rely on.

Frequently asked questions

How long should a strong password be?

At least 16 characters for most accounts, in line with CISA's advice. For high-value accounts like email or banking, aim for 20 or more. Our guide to password generator settings has more.

Are random password generators actually safe to use?

Only if they run locally and use a cryptographically secure source such as crypto.getRandomValues(); many use Math.random(), which is not built for security. This site's password generator uses crypto.getRandomValues(), but your password manager's generator is easier for real accounts since it also saves the result. Avoid any generator that requires an account or sends results by email.

Should I use a passphrase or a random password?

Use a passphrase for anything you type manually; it is easier to remember and still very strong when the words are chosen randomly. Use a fully random password for anything stored in a password manager, where memorability is irrelevant.

Do special characters make a big difference?

They help, but only when placed randomly. Predictable substitutions like '3' for 'e' or '!' at the end are already in attacker dictionaries. Random placement of symbols on a long password adds real entropy; bolting them onto a word does not.

Sources

1. Password Strength — xkcd
2. EFF's New Wordlists for Random Passphrases — Electronic Frontier Foundation
3. Use Strong Passwords — Cybersecurity and Infrastructure Security Agency
4. Crypto: getRandomValues() method — MDN Web Docs