How to make a strong password (length beats symbols)
Most of us were taught to swap letters for symbols: P@ssw0rd!. It feels clever, and it is not. What matters far more is length and randomness.
How strength is measured
Security people count the number of guesses an attacker would need. For a truly random password this is the character pool size raised to the power of the length. In bits, that is the length multiplied by the base-2 logarithm of the pool size. Each extra bit doubles the work.
Length versus symbols: a comparison
- 12 random characters from all 94 typeable characters: about 79 bits.
- 16 random lowercase letters only: about 75 bits.
- 20 random lowercase letters only: about 94 bits.
What that tells you
Four extra lowercase letters can be worth more than adding a whole set of symbols. Length is the cheapest way to add strength. The numbers above only apply to randomly chosen characters. A password a human invents, like a word with a number at the end, is far weaker than its length suggests, because attackers try common patterns first.
Use random, not clever
Let a generator pick. The Toolstia password generator uses your browser's secure random generator, builds the password on your device, and never sends or stores it. For important accounts, aim for 16 characters or more.
Passphrases for things you must remember
You cannot memorise dozens of random strings, but you can remember a few words. A passphrase of five or six words chosen randomly from a large word list is long and easier to recall than a short jumble. The words must be picked at random, not from a favourite quote or lyric. This is a good choice for the one password that unlocks your password manager.
The habits that matter more than the password
- Use a different password for every account, so one leak does not open the rest.
- Store them in a password manager rather than your memory or a notes file.
- Turn on two-step verification wherever it is offered, ideally with an authenticator app or a security key.
- Change a password when you learn it was exposed, not on a fixed schedule.
What official guidance says
Current guidance from standards bodies such as NIST puts the emphasis on length, discourages forced mixes of symbols and numbers, and advises against making people change passwords on a timer without a reason. Check the latest published version if you set rules for an organisation.