← All articles · Guides · about 4 min read

What makes a password strong (and why length wins)

Look at a wall of password requirements sometime. "At least 8 characters. One uppercase. One number. One symbol." It feels like security. It mostly isn't.

The truth is embarrassing for those rule-makers: P@ssw0rd! clears every checkbox on that list and a bored attacker cracks it in seconds. Meanwhile correct-horse-battery-staple looks like a sentence a child wrote and would take a computer longer than the age of the universe to guess. Length did that. Not the exclamation mark.

So what's actually going on? It comes down to one word: combinations.

The math, without the math headache

Every password is a guess. An attacker doesn't try to "hack" it character by character like in films — they try possibilities, fast, by the million. How long that takes depends on how many possible passwords your format allows.

Picture a lock with wheels. Each wheel you add multiplies the work. A 4-digit PIN has 10,000 combos — a phone tries those in a blink. A password made of 8 random lowercase letters has 26×26… (26 to the 8th) — about 200 billion. Sounds like a lot. It isn't, for a computer doing billions a second.

Now add length. Twelve random lowercase letters is 26 to the 12th — roughly 90 trillion trillion. Each extra character you add doesn't add a little safety; it multiplies the pool by the whole alphabet again. That's the trick. Length isn't one factor among many — it's the factor that compounds.

Why "P@ssw0rd!" is a sitting duck

Those capital-plus-number-plus-symbol rules push people toward predictable swaps: a becomes @, o becomes 0, add a ! at the end. Attackers know this. Their guess lists include every "password" with those exact swaps near the top. Your clever-looking password was the first thing they tried.

Worse, short passwords get exhausted no matter how fancy. Eight characters, even with all four character types, is only so many combinations. A 2020s GPU chews through the whole space in minutes to hours. The complexity bought you almost nothing; the length is what you needed.

This is why NIST — the US body that writes the actual guidance — dropped the mix-of-everything rule years ago. Modern advice is basically: make it long, make it random, stop forcing symbols.

Passphrases: the thing that's both safe and usable

Here's the part nobody tells you: the strongest passwords are the ones you can remember without writing them on a sticky note. A string of four or five random common words — train-brick-coffee-moon — is long enough to be brutally hard to crack and short enough to actually recall.

That's the sweet spot. Humans are bad at random; we're fine at words. So lean on words, and lean on length. Twelve-plus characters, pulled from a big random pool, and you're ahead of 99% of what's out there.

The one rule within the rule: the words have to be random, not a quote or a song line. "to-be-or-not-to-be" is four common words in an order everyone knows, so it's a weak passphrase. The generator below picks words you'd never stitch together on purpose — that's the point.

Where a generator earns its keep

You can't reliably invent randomness in your head. Nobody can — we pick "memorable" patterns without meaning to, and attackers exploit exactly those. So for anything that matters (email, bank, that domain registrar account), let a generator do it:

  1. Open the Password Generator on tool80.com.
  2. Set it long — 16 characters or more. Bump it up for anything important; there's no downside to "too long."
  3. Want something you can type on a phone? Use the passphrase mode (random words, dashes between). Want max entropy in a form that only accepts symbols? switch to the character soup.
  4. Copy it, paste it into a password manager, and don't reuse it anywhere else. That last bit matters more than people think — one leaked password on one site is harmless until it's the same password on your email.

It all runs in your browser. The password is built on your device and never sent to us; we don't see it, we don't log it. (The site uses basic anonymous analytics to check pages work — details in the privacy policy.)

A few honest habits

Quick answers

How long is "long enough"?
For most accounts, 12 random characters is a solid floor; 16 is comfortable. For the few accounts that guard everything (email, password manager), go 20+.

Symbols or no symbols?
Doesn't matter much once you're long and random. Symbols help mostly when a site forces a short limit — there they squeeze in a bit more variety. Otherwise, words win on memorability for the same strength.

Is a passphrase really as safe as gibberish?
Yes, if the words are random. Four random words is roughly the strength of an 11-character random mix; five words clears most threat models comfortably.

Should I write it down?
For your password-manager master password, a paper copy in a drawer beats reusing "Password123" across the web. Just don't tape it to the monitor.

So the next time a form demands a symbol, remember: the exclamation mark is theater. The length is the lock. Go make one that's actually long.

← Back to all articles