Why "P@ssw0rd1!" Is Weaker Than It Looks
Swapping in @ for a and a 0 for o felt like a genuinely clever move, the kind of trick that should count for something. Finding out it's one of the first things a cracking tool tries lands like a bit of a letdown. Turning "password" into "P@ssw0rd1!" feels like meaningful extra protection. To real cracking software, it barely registers as an obstacle. Because that exact substitution pattern is one of the first things it tries.
Cracking tools ship with these substitutions built in
Password-cracking software like Hashcat and John the Ripper. Real, widely used, well-documented tools. Include built-in "mangling rules" that automatically apply common substitutions (@ for a, 0 for o, 1 for i or l, an ! appended at the end) to every word in a dictionary as a standard, near-instant step of an attack. These aren't obscure techniques; they're default, out-of-the-box behavior specifically because the substitution patterns are so predictable and so widely used by real people.
That's a deflating thing to learn, especially if a password-strength meter has spent years telling you the substitution counts as "excellent." The meter isn't lying about the character variety; it's just answering a different question than "how fast would a real attacker guess this," which is the question that actually matters.
Why the entropy math doesn't apply here
Raw entropy calculations (the kind that compare password strength by character-set size and length) assume every character was chosen independently and unpredictably. A dictionary word with a few predictable substitutions is nowhere close to that assumption. It's a small, well-known transformation of a much smaller, guessable space, which is exactly why a dictionary-plus-rules attack can crack a "complex-looking" substituted password enormously faster than its character count and symbol variety alone would suggest.
Real breach data backs this up directly
Analyses of leaked password databases. A well-studied area of security research following numerous real breaches over the years. Consistently find these exact substitution patterns clustered among the very first entries in attackers' wordlists, precisely because they're common enough in real passwords to be worth checking before anything more computationally expensive.
What to actually do about it
If the goal is a password that actually holds up, the fix isn't more symbols stacked on a guessable word, it's genuinely unpredictable word choice: a long passphrase built from unrelated words has no common word or predictable pattern for a mangling rule to start from in the first place. If the goal is figuring out whether a password you already use is at risk, run it through a checker that models real cracking behavior rather than just counting character classes; a raw entropy score alone won't catch a leetspeak substitution the way an actual dictionary-plus-rules attack would. If the goal is just not feeling like the years of typing "@" and "0" were wasted effort, they weren't wrong to add unpredictability, just wrong about which kind. Length and genuine randomness are the versions of that same instinct that actually work.
Check your own password's entropy and estimated crack time with the password strength checker.