The complexity illusion
Many people believe adding symbols and mixed case is what makes a password safe. Strength is really about entropy, driven by length × character-set size, and length matters most: every extra character multiplies the search space exponentially.
A quick comparison
- 8 lowercase characters: about 2^37 combinations;
- 12 characters (upper+lower+digits): about 2^71;
- 16 characters (with symbols): about 2^104.
Practical rules
- Length first: at least 12 characters, 16+ when possible;
- A unique password per site so one leak does not open everything;
- Store them in a password manager, nobody memorizes this many random strings;
- Enable two-factor authentication as a second line of defense.
Common myth
"P@ssw0rd!" looks complex but is a dictionary word with common substitutions, weak against dictionary attacks. Truly random, meaningless strings are what make a password strong; that is exactly what a generator is for.
Cracking time at a glance
Assuming 10 billion guesses per second (a conservative offline GPU cluster):
| Password shape | Character set | Rough exhaustion time |
|---|---|---|
| 8 lowercase letters | 26 | Minutes |
| 8 chars, upper + lower + digits | 62 | Hours |
| 12 chars, upper + lower + digits | 62 | Centuries |
| 16 chars with symbols | 94 | Far beyond the age of the universe |
This assumes the password is truly random. A dictionary word with substitutions (P@ssw0rd) collapses to seconds under a dictionary attack, that is the "looks complex" trap.
Three things that actually work
- Random passwords in a manager: 16+ random characters stored in a password manager; you memorize only the master password;
- Passphrases: four or more unrelated words make a memorable, high-entropy secret;
- Two-factor authentication: a second door even after a leak, TOTP apps and hardware keys beat SMS codes.
Try it: Password generator