Passwords and Passphrases: What Actually Makes One Strong
Most password advice is a decade out of date. The rules many sites still enforce — one uppercase, one digit, one symbol, change it every ninety days — were guesses that turned out to make passwords harder for people and barely harder for machines. What actually matters is simpler than the rules suggest, and it is worth understanding rather than memorising.
Length beats cleverness
The strength of a password is the number of possibilities an attacker must work through, and that number grows exponentially with length but only linearly with alphabet size. Adding one character to a lowercase password multiplies the work by 26; adding symbols to the alphabet of a short password multiplies it by a much smaller factor overall. Twelve random lowercase letters is dramatically stronger than eight characters drawn from everything on the keyboard.
This is why substitution tricks fail. Replacing letters with lookalike symbols — an @ for a, a 3 for e — produces something a human finds hard to type and a cracking tool expands in milliseconds, because those substitutions are the first thing every wordlist tries. A predictable transformation of a common word inherits the weakness of the common word.
Where strength meters mislead
A meter that just counts character classes will happily call Password1! strong: it has upper, lower, a digit and a symbol, and it is among the first few thousand guesses any attacker makes. Better meters estimate how many guesses the password would survive by modelling dictionaries, keyboard patterns, dates and common substitutions — a far more useful question than which character types are present.
Treat any meter as a lower bound on weakness, not a certificate of strength. It can tell you convincingly that something is bad. It cannot know whether your password has already appeared in a breach corpus, which is the single most important fact about it — a password that is unique and never reused matters more than one that scores well.
Passphrases: strength you can actually remember
A passphrase is several random words strung together, and its strength comes from the number of words and the size of the list they were drawn from — not from looking complicated. Choosing six words at random from a list of 7,776 gives about 77 bits of entropy, comfortably beyond what offline cracking reaches, while remaining something a person can hold in their head and type on a phone.
The critical word is random. Words you choose yourself are not random: people pick related words, names, and phrases that appear in song lyrics or books, and that structure is exactly what attackers model. The words must come from a genuinely random process, which is the entire point of the dice-based method — and why a passphrase you invented is not equivalent to one you generated.
Reuse is the real risk
Almost nobody is compromised by an attacker brute-forcing their password. They are compromised because a site they signed up for years ago was breached, and the same password worked on their email. Credential stuffing — replaying leaked pairs across other services — is cheap, automated and enormously effective, and no amount of complexity in a reused password prevents it.
That makes uniqueness the property worth optimising for, and uniqueness at scale requires a password manager. Once every password is unique and generated, their individual memorability stops mattering, and the only one you need to remember is the one protecting the manager itself — which is exactly where a long passphrase earns its keep.
What two-factor actually protects
A second factor defends against a stolen or guessed password, and it does that very well: knowing the password is no longer sufficient. Time-based one-time codes are derived from a shared secret and the current time, which is why they work offline and why the clock on your device has to be roughly correct.
But be clear about what it does not cover. A convincing phishing page can ask for the code as readily as the password and replay both immediately, and SMS codes can be intercepted by taking over the phone number. Codes from an authenticator app are meaningfully better than SMS; hardware keys, which refuse to authenticate to the wrong domain, are better still because they remove the human from the decision entirely.
- Prefer length over character-class gymnastics — aim for a long passphrase.
- Never reuse a password; uniqueness protects you more than complexity.
- Generate passwords rather than inventing them; human choices are patterned.
- Use an authenticator app over SMS, and a hardware key where it is offered.
- Change a password when there is a reason to, not on an arbitrary schedule.