How Strong Does a Password Actually Need to Be?

Password strength is conventionally measured in bits of entropy — roughly, how many attempts a brute-force attacker would need to try before exhausting every possibility, where each additional bit doubles that number. A random password drawn from a reasonably sized character set reaches a strength — somewhere around 70 to 80 bits for a password in the 14-to-16-character range — that sits comfortably beyond what any brute-force attack against a properly secured account could exhaust in a practical timeframe, whether the attacker is guessing online against a rate-limited login form or offline against a stolen, properly hashed password database. Past that threshold, adding more bits of theoretical strength keeps a password "more resistant to brute force" only in an abstract sense that stops mattering in practice, because brute force was never the realistic threat for a password already in that range.

Security research and breach post-mortems consistently point to a different, less glamorous cause behind the large majority of real-world account takeovers: credential stuffing, where an attacker takes a list of email-and-password pairs leaked from one breached service and simply tries the same pairs against other services, banking on the extremely common habit of reusing a password across multiple accounts. A password that is individually extremely strong — dozens of bits of entropy, drawn from a huge character set — provides exactly zero protection against this specific attack if it is reused anywhere else and that other service was ever breached, because the attacker is not trying to guess the password at all; they already have it, verbatim, from an entirely different leak. This is precisely why password uniqueness across services is arguably a bigger practical lever on real-world account safety than raw password strength is, a conclusion that surprises people who have absorbed "make it stronger" as the whole of password advice.

A password manager sidesteps the entire strength-versus-memorability tension by removing the need to remember most passwords at all: it can generate and store a long, fully random, unique password for every account without asking a human to recall any of them, closing off credential stuffing as an attack vector for every account it manages, since no two are ever the same and a leak of one tells an attacker nothing usable about any other. This is why the practical, honest recommendation for the overwhelming majority of online accounts is simply to use a password manager and let it generate maximum-length random passwords — the strength-versus-memorability question that most password advice agonises over only remains a real design tradeoff for the small handful of passwords that genuinely cannot live inside a manager, chiefly the manager's own master password and full-disk encryption passphrases, which is exactly why memorable passphrases built from random dictionary words remain a specifically useful tool for that narrow, genuinely unavoidable case.

For years, official guidance from bodies like NIST recommended mandatory password complexity rules — a required mix of uppercase, lowercase, digits and symbols — along with forced periodic password rotation every 60 or 90 days, and organisations widely adopted both as standard policy. Later revisions to that same guidance dropped both recommendations, based on evidence that they were actively counterproductive in practice: forced complexity rules push people toward predictable substitution patterns an attacker's dictionary already accounts for (a mandatory symbol reliably becomes "!" at the end, a mandatory digit reliably becomes replacing an "o" with a "0"), and forced periodic rotation pushes people toward small, predictable, incremental changes to an existing password rather than genuinely new ones, while adding real friction that measurably increases how often people write passwords down or reuse them elsewhere out of frustration. Current guidance instead emphasises length, checking new passwords against known-breached password lists, and dropping forced rotation in favour of rotating only when a specific account is actually known to be compromised — a shift driven by evidence about what genuinely improves real-world security rather than what merely looks rigorous on a compliance checklist.

For an ordinary online account behind a password manager: a fully random password of at least sixteen characters drawn from a large character set is comfortably past the point where strength is the limiting factor, and the practically important step is simply that it be unique to that one account. For a master password or an encryption passphrase that must be memorised and typed by hand: a passphrase of five or six words drawn randomly from a large word list reaches comparable strength to a shorter random-character password while remaining genuinely possible to memorise and type reliably, which is the specific case where the length-versus-memorability tradeoff is real and worth thinking about carefully. And for every account in between, the single highest-leverage habit is not agonising over whether a password is strong enough in the abstract — it is making sure it is not the same password protecting anything else, since that is the failure mode actually responsible for most real compromise.