What Makes a Password Actually Strong (and What Doesn't)

Most of the password advice people grew up with — swap "a" for "@", capitalize a random letter, add a "!" at the end — turns out to do very little against how passwords are actually cracked today. Understanding why changes what's actually worth doing.

Length beats complexity

A password cracker doesn't guess character-by-character the way a person might; it runs through enormous precomputed lists of common passwords and patterns first, then brute-forces the rest. Adding a "1" or "!" to a common word barely slows this down, because crackers already account for these substitutions. What genuinely slows down a brute-force attack is raw length — each additional character multiplies the number of possible combinations, and multiplication compounds fast. A 16-character password of random words is dramatically harder to crack than an 8-character password stuffed with symbols.

Why "random" matters more than "complex"

The real vulnerability in most passwords isn't insufficient symbol variety — it's predictability. Passwords based on real words, names, dates, or keyboard patterns (qwerty123, for instance) are vulnerable regardless of how many symbols you bolt on, because they're the first things a cracking dictionary tries. A password generated from genuinely random characters, or a passphrase of several unrelated random words, resists this in a way that "P@ssw0rd!" never will.

Reuse is the bigger risk, not weak individual passwords

Even a strong password becomes a liability if you reuse it across multiple accounts — one data breach anywhere in that chain exposes every account using that password. This is, in practice, a bigger real-world risk than password strength itself. A unique password per account, managed through a password manager, closes this gap far more effectively than making every password more "complex."

What password strength meters actually measure

Most strength meters estimate the mathematical entropy of a password — essentially, how many guesses a brute-force attacker would need on average. They generally can't detect if you've used a personally identifiable pattern (like a pet's name plus your birth year), which is why a password can score "strong" on a meter while still being guessable by someone who knows you.

Try it yourself

Our Password Generator creates genuinely random passwords of adjustable length, generated entirely in your browser and never sent anywhere.

This guide covers general password security principles, not guidance for any specific compliance framework or organizational password policy.