What password strength actually measures
Strength is the number of guesses an attacker must make before finding your password, expressed in bits: each extra bit doubles the work. A password drawn at random from a pool of 95 printable characters carries about 6.5 bits per character, so twelve characters gives roughly 79 bits. Anything predictable — a dictionary word, a name, a date, a keyboard run, a substitution like P@ssw0rd — collapses that estimate, because attackers try those candidates first.
This is why length beats complexity. Adding one character multiplies the search space by the size of your character pool; adding one exclamation mark to a short password barely moves the number and is exactly what cracking rules expect. Five random words — around 64 bits with a large word list — are stronger and far easier to remember than eight characters of punctuation soup.
Entropy targets worth using
| Entropy | Roughly equivalent to | Suitable for |
|---|---|---|
| < 40 bits | 6 random letters and digits | Nothing |
| 40–60 bits | 9 mixed characters | Throwaway accounts |
| 60–80 bits | 12 mixed characters, 5 random words | Everyday accounts |
| 80+ bits | 16 mixed characters, 6 random words | Email, banking, vault master password |
Why the same password has five different crack times
Your password's strength is only half the equation; the other half is how the service stored it — something you cannot control and rarely learn until after a breach. The same twelve-character password behind an unsalted MD5 column and behind bcrypt at cost 12 differs by roughly seven orders of magnitude in attack cost. That asymmetry is why unique passwords per site matter so much: you are betting on every service's storage decisions at once. A password manager plus a second factor removes that bet almost entirely. If you build the service, the password hash generator shows what the storage side should look like.
Practical habits that outperform complexity rules
- Use a password manager and let it generate 16+ random characters per site. You only memorise the master password.
- Make the master password a passphrase of five or six unrelated words — high entropy, typeable from memory.
- Turn on a second factor, preferring passkeys or a TOTP app over SMS.
- Never reuse. Credential stuffing tries breached pairs everywhere within hours of a leak.
- Rotate on evidence, not on a calendar. Forced 90-day changes push people toward predictable increments; NIST SP 800-63B dropped the recommendation.