What Makes a Password Strong?

Password strength is measured in entropy — the number of possible combinations an attacker would need to try. Higher entropy = stronger password.

Common misconceptions: • "P@ssw0rd!" has very low entropy despite meeting typical "complexity requirements" — it's in every attacker dictionary • A 20-character lowercase passphrase has more entropy than a 10-character complex password • Adding special characters helps less than adding length

The formula is simple: Length × Randomness = Strength

A truly random 16-character password using uppercase, lowercase, digits, and symbols has about 105 bits of entropy. A four-word diceware passphrase has about 51 bits — still adequate for most purposes and far more memorable.

Diceware Passphrases

Diceware is the gold standard for creating memorable yet secure passwords:

  1. Roll five dice (or use a cryptographic random number generator)
  2. Look up the resulting number in the diceware word list
  3. Repeat for 4-6 words
  4. String the words together with spaces or hyphens

Example: "correct horse battery staple" (from xkcd, don't actually use this one!)

Four diceware words provide about 51 bits of entropy. Five words provide about 64 bits. Six words provide about 77 bits — sufficient for even the most critical applications.

The key advantage: these passphrases are memorable. You can recount a story or mental image with the words, making them easy to recall without writing down.

Password Attack Methods

Understanding how passwords are attacked helps you create better ones:

Brute Force: Trying every possible combination. Effective against short passwords but computationally infeasible against long ones. A 256-bit key is immune; a 6-character password is not.

Dictionary Attack: Trying common words and phrases. This is why single dictionary words are terrible passwords regardless of length.

Credential Stuffing: Using passwords leaked from one breach to access other services. Defeated by using unique passwords for every service.

Phishing: Tricking you into entering your password on a fake website. Defeated by using a password manager (it won't auto-fill on the wrong domain) and MFA.

Rainbow Tables: Pre-computed tables of password hashes. Defeated by proper salting (which all modern services implement).

The most practical protection against all of these: use a password manager with unique, randomly generated passwords for every service, a strong master password that you memorize, and MFA on everything.