Almost everyone follows password rules invented for a threat model that no longer exists. The mandatory capital letter, the trailing exclamation mark, the ninety-day rotation — these come from an era when attackers guessed passwords one at a time over a network. Today they steal a database of hashes and attack it offline, at billions of guesses per second, with dictionaries built from every previous breach. What defeats that is not cleverness. It is entropy.
What entropy actually measures
Entropy, measured in bits, describes how many guesses an attacker needs on average. Each additional bit doubles that number. For a password drawn randomly from an alphabet of size N with length L, the entropy is L × log₂(N).
| Alphabet | Bits per character | 8 characters | 16 characters |
|---|---|---|---|
| Digits only (10) | 3.3 | 27 bits | 53 bits |
| Lowercase (26) | 4.7 | 38 bits | 75 bits |
| Letters + digits (62) | 5.95 | 48 bits | 95 bits |
| Full printable ASCII (95) | 6.6 | 53 bits | 105 bits |
Read the table across and the point is unmissable: doubling the length doubles the entropy, while expanding the alphabet from 26 to 95 characters adds only 40%. Length is multiplicative; complexity is additive. This is the single most useful fact about passwords.
What an attacker can actually do
A single modern GPU can compute tens of billions of MD5 hashes per second, and rigs of eight are ordinary. Against a fast hash like MD5 or unsalted SHA-1, an 8-character random password from the full ASCII set falls in hours. Against a slow, memory-hard function such as bcrypt or Argon2 with sensible parameters, the same rig manages perhaps tens of thousands of guesses per second — a difference of six orders of magnitude.
You cannot control which algorithm a service uses to store your password, which is exactly why your own margin has to be generous. Aim for 80 bits or more on anything that matters, and you remain out of reach even if the service stored your password badly.
Password Generator Generate a random password of any length and character set, entirely in your browser. Open the toolPassphrases: entropy you can remember
Four words picked at random from a 7,776-word Diceware list carry 4 × log₂(7776) ≈ 51.7 bits. Six words carry 77.5 bits, and seven carry 90 — comfortably beyond reach, while remaining something a human can memorise and type on a phone keyboard.
The crucial word is random. A phrase you composed yourself is a sentence, and sentences follow grammar and word-frequency patterns that cracking tools model well. The strength comes from the dice, not from the words.
The strategy that works in practice
- 1 Use a password manager for everything. It generates long random passwords per site and removes the reuse problem entirely — reuse, not weakness, is what turns one breach into ten compromised accounts.
- 2 Memorise exactly three passwords: your device login, your password manager master password, and your primary email. Everything else lives in the manager.
- 3 Make those three long random passphrases of six or seven words. Nothing else needs to be memorable.
- 4 Turn on two-factor authentication wherever it exists, preferring an authenticator app or a hardware key over SMS, which is vulnerable to SIM swapping.
- 5 Stop rotating passwords on a schedule. Both NIST and the UK NCSC now advise against it, because forced rotation pushes people towards predictable variations. Change a password when there is a reason to.
What to stop doing
- Substituting characters — a for @, o for 0, e for 3. Every cracking tool has applied these rules since the 1990s; they add almost no entropy.
- Building passwords from personal data. Birthdays, pet names, team names and postcodes are the first thing a targeted attack tries.
- Reusing a password anywhere. Credential-stuffing attacks replay breached pairs across hundreds of sites automatically.
- Trusting an on-screen strength meter. Most measure character classes, not entropy, and rate Password123! as strong.
For developers storing passwords
Never store passwords reversibly, and never hash them with a fast general-purpose function. Use Argon2id where available, or bcrypt or scrypt, each with a unique per-user salt and cost parameters tuned so that verification takes roughly 100 to 250 milliseconds on your hardware. That delay is imperceptible for a login and devastating for an attacker running billions of attempts.
Enforce a minimum length of at least 12 characters, accept long passphrases and every Unicode character, and check new passwords against a breached-password list. Then stop imposing composition rules — they harm more than they help.