How to Create a Strong Password — Length, Character Sets, Entropy

A strong password is one that is hard for others to guess and resistant to brute-force cracking. Rather than making it "complicated" by feel, understanding why it becomes strong leads to safe, sustainable habits. This guide explains the criteria simply.

The idea of entropy (bits)

Password strength can be expressed as "entropy," a logarithm of the total number of possibilities, measured in bits. Each additional bit of entropy roughly doubles the number of attempts needed to crack it. As a rule of thumb, above 70 bits is considered strong.

Entropy comes from the number of character types and the length. With N possible characters and length L, the possibilities are N to the power of L. The key insight: length increases the number of multiplications, so lengthening a password strengthens it more efficiently than adding character types.

Length vs. character variety: which wins?

• Increase length: the biggest effect — a few more characters raises entropy substantially
• Add character types: helpful, but less than length; lengthening often beats adding symbols
• Avoid guessable elements: names, birthdays, dictionary words, and keyboard patterns (qwerty) effectively lower entropy

Strength in real numbers: brute-force time estimates

Beyond the theory, seeing the actual magnitudes makes the effect of length concrete. Below are worst-case estimates for an attacker trying 10 billion guesses per second (10^10) to brute-force a random password (computed on this site). Words in dictionaries or breach lists fall far faster, so treat these as upper bounds that assume a truly random string.

• 8 chars, lowercase only (26) — about 2.1×10^11 combinations / roughly 21 seconds to exhaust
• 8 chars, upper+lower+digits (62) — about 2.2×10^14 / roughly 6 hours
• 8 chars, upper+lower+digits+symbols (94) — about 6.1×10^15 / roughly 7 days
• 12 chars, upper+lower+digits (62) — about 3.2×10^21 / roughly 10,000 years
• 12 chars, upper+lower+digits+symbols (94) — about 4.8×10^23 / roughly 1.5 million years
• 16 chars, upper+lower+digits+symbols (94) — about 3.7×10^31 / effectively unbreakable (about 10^14 years)

The takeaway is clear. An 8-character password falls within days even with symbols, while moving to 12 characters vaults the magnitude up so it cannot be cracked in any realistic time. The numbers confirm that length beats character variety.

Reuse is the biggest risk

No matter how strong, reusing a password across services is dangerous. If one service leaks, attackers can break into others that share the same password (credential-stuffing). Using a different password per service matters even more than length or character variety.

Current guidance: length over complexity, no periodic changes

The digital identity guidelines from NIST (the U.S. standards body), SP 800-63B (2024 revision, Rev. 4), substantially revise what was long considered "common sense" for passwords. The key points are below. Services that still force "change every 90 days" or "must include a symbol" are behind this current thinking.

• Prioritize length — a minimum of 8 characters, with 15 or more recommended when used as a single factor. Services should allow at least 64 characters and accept any character, including spaces.
• Do not force complexity — composition rules like "must mix upper, lower, digits, and symbols" should not be imposed. Length is more effective, and forced complexity leads to hard-to-remember passwords and reuse.
• Do not require periodic changes — passwords should not be rotated on a schedule unless there is a specific reason such as evidence of compromise. Frequent forced changes tend to produce guessable variations (e.g. bumping a trailing number).
• Check against breach lists — new passwords should be compared against lists of commonly used or previously breached passwords, and a different one required if there is a match.

Passphrases as an option

For passwords you must remember (like a password manager’s master password), a "passphrase" of several unrelated words works well. It is easy to make long — earning entropy — and easier to remember than a meaningless random string. But proverbs, famous lyrics, and simple word joins are guessable, so choose mutually unrelated, random words.

Pair it with two-factor authentication (MFA)

However strong a password is, you cannot reduce the risk of a leak to zero. Adding two-factor authentication (MFA) via an authenticator app or security key greatly reduces unauthorized logins even if a password leaks. Authenticator apps and security keys are considered safer than SMS. Always enable it for important accounts.

Practical habits

The most practical approach is a long, random, unique password per service, stored in a password manager — so you only need to remember the manager’s master password. Our password generator creates strong passwords with cryptographic randomness and shows entropy and a strength meter. Register the generated password directly into your manager for safety.

Reference: NIST Special Publication 800-63B (Digital Identity Guidelines). The password-practice statements in this article reflect the current thinking of this U.S. standard.