What Actually Makes a Password Strong (And What Doesn't)

Most password advice focuses on rules — one uppercase letter, one number, one symbol — that are easy to satisfy without actually making a password hard to guess. "Password1!" checks every box on that list and would still fall in seconds to any real attack. The rules aren't wrong, exactly; they're just aimed at the wrong target.

What actually determines strength: entropy

A password's real strength is measured in entropy — roughly, how many guesses an attacker would need to try before finding it by brute force. Entropy comes from two things multiplied together: how large the pool of possible characters is, and how long the password is. Length matters more than almost anything else, because each additional character multiplies the total number of possible combinations rather than just adding to it.

This is why a long, plain phrase like correcthorsebatterystaple can be dramatically harder to brute-force than a short, symbol-heavy one like P@55w0rd! — despite looking "weaker" by the traditional rules.

The two things that actually break passwords in practice

Brute force is rarely how real accounts get compromised. Two other methods do almost all the damage:

• Dictionary and pattern attacks. Attackers don't try random characters — they try real words, names, keyboard patterns (qwerty, 123456), and common substitutions (@ for a, 0 for o) first, because that's what most "complex" passwords actually are. A password that looks random to a human but follows a common pattern offers far less real protection than it seems to.
• Credential reuse. When one site gets breached, attackers try the same email-and-password combination everywhere else. A genuinely strong, unique password on a site that gets breached is still useless if you reused it on your email account.

What actually helps

1. Length over complexity. Aim for 12-16+ characters before worrying about symbol variety.
2. Avoid anything guessable from your life — names, birthdays, pet names — even disguised with substitutions.
3. Never reuse a password across accounts, especially not on anything tied to your email, since email is usually the recovery path into everything else.
4. Use a password manager so "long and unique" doesn't mean "hard to remember."

Check where you actually stand

The Password Strength Checker scores a password against these real criteria, includes a generator for creating long random passwords on the spot, and runs entirely in your browser — nothing you type is ever sent anywhere.