Password Strength: Length Beats Complexity
If a password checker keeps flagging "weak" even after you've swapped in a capital letter, a digit, and a symbol, the checker isn't wrong to be cautious, it's just measuring the wrong thing. For years, "strong password" meant exactly that swap: password → P@ssw0rd!. The organization that pushed the rule has since said, in effect, that it was a mistake. Here's the math on why, and what actually keeps an account safe.
Where the complexity rule came from
The "uppercase, lowercase, number, symbol" requirement traces back to a 2003 document written for the U.S. National Institute of Standards and Technology by a manager named Bill Burr. It recommended mandatory character-class mixing and regular forced password changes. It became the default template copied into login forms everywhere for the next decade and a half.
The problem: it optimized for the wrong thing. Given those rules, people didn't pick unpredictable passwords. They picked predictable ones that technically satisfied the rules. "Password1!" passes every character-class check a form typically enforces, and is one of the first guesses in any real attack. Forced periodic changes made it worse, pushing people toward "Password1!", "Password2!", "Password3!", a pattern crackers learned to anticipate. NIST's own 2017 guidance (SP 800-63B) reversed both recommendations, dropping mandatory complexity rules and periodic forced changes in favor of length and screening against known-breached password lists.
The math: why length wins
Password strength against brute-force guessing comes down to entropy. How many possible combinations an attacker has to search through. That's determined by two numbers: the size of the character set, and the length.
- An 8-character password using upper, lower, digits, and symbols (~94 possible characters) has about 94⁸ ≈ 6 × 10¹⁵ possible combinations.
- A 5-word passphrase drawn from a 7,776-word list (the standard Diceware wordlist) has 7,776⁵ ≈ 2.8 × 10¹⁹ possible combinations. About 4,700 times more.
The passphrase wins despite using "only" lowercase words with no symbols, because length dominates the math. Every additional character in a random string multiplies the search space by the alphabet size (roughly ×94 per character above); every additional word in a passphrase multiplies it by the wordlist size (×7,776 per word). Adding one more word does far more work than adding one more symbol.
Why this matters against real attacks
The fear underneath all of this is usually some version of "am I about to get hacked," and the honest answer splits in two, because two different threats call for two different defenses:
- Offline brute-force / GPU cracking (when an attacker has stolen a database of hashed passwords and can guess offline at high speed): entropy is what slows this down, and length is the cheapest way to add entropy.
- Credential stuffing / online guessing (using leaked passwords from one breach to try logging into other sites): no amount of complexity helps if you reused a password that already leaked. This is what password-breach screening (checking new passwords against known-leaked lists, which NIST now recommends over complexity rules) actually defends against, and it's why a unique password per site matters more than a clever one.
That second point is also where most real-world account takeovers actually come from, not from someone guessing a password character by character, but from a password reused on a site that got breached somewhere else. Length fixes the first threat. Only uniqueness fixes the second, and no amount of added complexity substitutes for it.
What to actually do about it
If the goal is a password you can defend against brute-force guessing, prioritize length first: 12+ characters, or 4-5+ random words for a passphrase. If the goal is not getting swept up in someone else's breach, prioritize uniqueness: never reuse a password across sites, full stop. Complexity comes last, and mostly matters for satisfying sites that still enforce old-style character rules rather than for security itself.
Keeping dozens of long, unique passphrases straight in your head isn't realistic, which is exactly the job a password manager is built for; it's a lower risk than reuse, not a higher one, since the alternative most people fall back on is reusing a handful of memorable passwords everywhere. A long, unique passphrase you don't have to remember beats a short "clever" one you do, nearly every time.
Generate one now with the password & passphrase generator. Switch to passphrase mode for the length advantage above.