Password Security in Practice: How Long Is Long Enough?
2026-08-06
“Your password must be at least 8 characters and include uppercase letters, numbers, and a symbol.” You’ve seen that rule a hundred times. But few people stop to ask: why 8? And does P@ssw0rd! — which satisfies every part of that rule — actually keep you safe? This article skips the vague advice and answers one concrete question from the attacker’s point of view: how long does a password really need to be?
How Attackers Crack Passwords: Brute Force vs. Dictionary Attacks
To defend yourself, you first need to understand the opposition. Real-world password cracking comes in two main flavors.
Brute force is the dumbest but most thorough approach: start at aaaaaaaa and try every possible combination until one works. Its speed depends entirely on the size of the “search space” — the total number of possible passwords. A modern GPU can try billions to tens of billions of hashes per second in an offline attack, so the size of that search space determines how long your password survives.
Dictionary attacks are far smarter. Instead of enumerating every combination, the attacker works through a curated wordlist: real passwords from past data breaches, common English words, keyboard patterns like qwerty and 123456, and the usual mutations of all of these (a → @, o → 0, appending ! or a birth year). Dictionary attacks are brutally efficient because human-invented “complex” passwords turn out to be extremely predictable.
That’s why P@ssw0rd! fails. It’s ten characters with four character classes, but it’s just password wearing a disguise everyone recognizes — it sits near the top of every cracking wordlist. Character substitutions fool website validation rules, not attackers.
Entropy: A Ruler for Password Strength
Comparing passwords requires a measurable quantity, and that quantity is entropy. For a password of L characters chosen randomly from an alphabet of N symbols, the formula is:
entropy = L × log₂(N)
Intuitively, entropy tells you how hard the attacker has to work: a password with entropy E has a search space of 2^E candidates. Common alphabet sizes:
| Character set | Size N | Entropy per character |
|---|---|---|
| Lowercase letters | 26 | ~4.7 bits |
| Mixed case + digits | 62 | ~5.95 bits |
| Mixed case + digits + symbols | 94 | ~6.55 bits |
One crucial caveat: this formula assumes every character is chosen independently and at random. Passwords you invent in your head don’t qualify — the human brain has strong biases, so their real entropy is far below the calculated value. The formula measures random passwords, not passwords that merely look random.
Why Length Beats Complexity
Write the formula out and the conclusion is obvious: entropy grows linearly with length but only logarithmically with alphabet size. Adding one character multiplies the search space by N; widening the alphabet only nudges each character’s contribution from 4.7 to 6.55 bits. Run the numbers (assuming an offline attack at 10 billion guesses per second):
| Password | Entropy | Time to exhaust |
|---|---|---|
| 8 chars, lowercase only | ~37.6 bits | ~20 seconds |
| 8 chars, all four classes | ~52.4 bits | ~14 years |
| 12 chars, all four classes | ~78.6 bits | ~1.9 million years |
| 16 chars, all four classes | ~104.8 bits | longer than the age of the universe |
An 8-character password is tissue paper against a modern GPU no matter how “complex” it is. Push past 12 characters and the picture changes completely. This is why the security consensus has shifted from “8 characters, mixed types” to “longer is better, start at 16”. NIST’s current digital identity guidelines (SP 800-63B) explicitly favor length over forced character composition.
You can verify these numbers yourself with the Password Strength Checker. It uses exactly the entropy formula above and estimates crack time at one billion guesses per second — watch how the estimate jumps with every character you add.
Passwords You Should Never Use
Regardless of length, these categories are off the table:
- Breach-list staples:
123456,password,qwerty,iloveyou. These are the first guesses of every dictionary attack and fall in milliseconds. - Personal information: birthdays, phone numbers, pet names, your favorite team. Most of it is effectively public via social media, and targeted attacks try it first.
- Keyboard patterns:
1qaz2wsx,zxcvbnm. They look random but follow fixed paths that every wordlist includes. - A word plus a number:
Summer2026,Dragon88. It’s the most common human password recipe, and cracking tools generate these variants in bulk. - Any password you’ve used before, anywhere: breaches happen constantly, and attackers immediately replay leaked email/password pairs against other sites — a technique called credential stuffing.
Password Managers: The Only Realistic Way to Unique Passwords
By now the conclusion is clear: a secure password must be long, random, and different for every site. No human brain can hold dozens of 16-character random strings — so stop trying, and delegate the job to a password manager.
Tools like Bitwarden, 1Password, or KeePassXC generate and store an independent random password for every account. You only need to remember one strong master password. If a site you use gets breached, the leaked password is a random string that’s useless everywhere else, and credential stuffing simply stops working on you. For the master password itself, use a passphrase — four or five randomly combined common words, correct-horse-battery-staple style: long, high-entropy, yet memorizable.
Generating Truly Random Passwords
“Random” is all about the source. The human brain is a terrible random number generator, and ordinary pseudo-random functions like Math.random() are unsuitable too — they’re designed for statistical evenness, not unpredictability. The right tool is a cryptographically secure random number generator (CSPRNG): crypto.getRandomValues() in the browser, /dev/urandom on the OS, or the secrets module in Python.
The easiest route is a generator that already does this correctly. The Password Generator on this site is built on the browser’s crypto.getRandomValues(): everything runs locally on your machine, and the passwords it produces are never sent to any server. Recommended settings in practice:
- Crank the length to 16 or more — you won’t be typing it anyway, so longer is free security.
- Enable all four character classes to maximize per-character entropy.
- If you must type or read the password aloud (a Wi-Fi password, say), turn on “exclude similar characters” to drop look-alikes like
l,1,I,O, and0.
Once generated, paste the result into the Password Strength Checker and glance at the estimated crack time to confirm it’s up to standard before putting it into service.
Summary: An Actionable Password Strategy
The whole article condenses into five to-do items:
- Use at least 12 characters everywhere; 16 or more for important accounts.
- Give every site a unique random password, and let a password manager handle generation and storage.
- Never build passwords from personal information, common words, or their predictable variants.
- Protect the master password with a long passphrase, and enable two-factor authentication (2FA) on important accounts.
- Get randomness from a CSPRNG — never “invent” randomness yourself.
Password security is ultimately a math contest: you don’t need an unbreakable password, just one expensive enough to crack that attackers move on to an easier target. Length plus randomness is the simplest way to win it.