Password Security: Strength Rules & Management

Rank

Password

Crack time

123456

instant (dictionary)

password

instant (dictionary)

123456789

instant (dictionary)

qwerty

instant (dictionary)

111111

instant (dictionary)

Key Takeaways

Entropy math: each added character multiplies crack time by the alphabet size (26-95×)

Length > complexity: 8 mixed chars ≈ hours-days; 14 random chars ≈ centuries; 4 random words ≈ millennia

Uniqueness is king: one reused password + one breach = every account falls (credential stuffing)

The stack: password manager + unique random passwords + 2FA = done

Core answer: Password strength scales with LENGTH × randomness: entropy ≈ length × log₂(character pool). A 16-char lowercase password (26¹⁶) ≈ 75 bits — centuries to brute-force; an 8-char "complex" P@ssw0rd pattern ≈ 30 bits — hours. Use a unique random password per site via a password manager; add 2FA on email, banking, and your password manager itself.

The entropy math

Password	Pool	Length	Entropy	Offline crack time (10¹⁰ guesses/s)
123456	—	6	~0 (in every dictionary)	instant
P@ssw0rd!	pattern	9	~30 bits effective	minutes
8 random mixed	94	8	52 bits	~14 years
12 random mixed	94	12	79 bits	~10¹⁰ years
5-word passphrase	7,776 (diceware)	5 words	65 bits	~10⁵ years
16-char random	94	16	105 bits	beyond heat death

Online attacks (rate-limited) vs offline (database leak, 10¹⁰+ guesses/s with GPUs) differ by a factor of a billion — that's why site breaches, not login pages, are the real threat model.

The three rules that actually protect you

Unique per site — credential stuffing (trying leaked email/password pairs everywhere) is the #1 real-world account takeover method; uniqueness kills it.
Random, not clever — "Tr0ub4dor&3" follows a human pattern crackers model; "correct horse battery staple" style random words beat it.
2FA on the crown jewels — email resets everything else; banking moves money. Hardware keys > authenticator apps > SMS (SIM-swap vulnerable).

Worked examples

Example 1 — The breach cascade. You reuse "Sunshine2020!" on a forum and your bank. The forum leaks in 2024; bots try the pair on 500 banking sites within hours. One unique password per site reduces this to a forum problem, not a life problem.

Example 2 — Passphrase construction. Roll dice for 5 random words: "glacier trumpet velvet canoe orbit" ≈ 65 bits, typeable in 6 seconds, memorable in a day.

Example 3 — Master password. Your manager's master password needs the most strength you'll ever memorize: 6+ random words (77+ bits), written on paper in a drawer for the first month.

Common mistakes and myths

"Complexity requirements make it strong" — P@ssw0rd1 satisfies every rule and tops breach dictionaries; length and uniqueness matter, symbol theater doesn't.
Forced 90-day rotation — NIST withdrew the advice: forced changes breed +1 increments ("Summer2024"→"Summer2025"). Change on evidence of compromise only.
Security questions as secrets — your mother's maiden name is on genealogy sites; answer with random words stored in your manager ("What street? → 'purple-anvil-73'").
Browser-saved = password manager — better than reuse, but dedicated managers add breach alerts, secure sharing, and phishing-resistant autofill domain checks.
Writing passwords down is always bad — a paper list in a locked drawer beats Password123 reused everywhere; threat models differ for home users vs open offices.

Frequently Asked Questions

What makes a password strong?

Entropy = log₂(charset^length) — bits of guessing work. 8 chars lowercase+upper+digits+symbols (95 set): 95⁸ ≈ 6.6×10¹⁵ ≈ 52 bits ≈ days-weeks offline. 14 random chars: 92 bits ≈ heat-death-of-universe territory. 4 random words from 7,776 (diceware): 51 bits but memorable. Length is the exponent — add characters before adding symbols.

How fast can passwords actually be cracked?

Offline attacks on leaked hashes run billions of tries/second (GPU rigs: ~100 billion MD5/s). At that rate: 6 lowercase chars — seconds; 8 mixed — hours; 10 mixed — years; 12 mixed — millennia. Online attacks face rate limits, so weak passwords (top-10,000 lists) fall first: "123456", "password", "qwerty" are tried before any brute force begins. Your enemy is the common-password list, then the GPU.

Why is password reuse so dangerous?

Credential stuffing: every breach (billions of accounts leaked) is replayed against every other site automatically. Your forum password from 2016 is in the lists; if your email or bank shares it, they fall without any "hacking" of those sites. One unique password per site caps the blast radius at one account. This is THE rule — everything else is secondary.

Should I use a password manager?

Yes — it is the only way to have 100+ unique 16-char random passwords (you will memorize 3-5 at most without one). Browser-built-in managers are fine for most; dedicated ones (Bitwarden, 1Password) add sharing/auditing. The master password becomes your one crown jewel: make it a long passphrase (5-6 words), never reused, with 2FA on the vault itself.

How much does 2FA add?

Microsoft data: 2FA blocks >99.9% of automated account attacks — a stolen password alone becomes useless. Hierarchy: hardware keys/passkeys > authenticator apps (TOTP) > SMS (SIM-swap vulnerable but vastly better than nothing). Priority accounts for full 2FA: email (the reset hub for everything), bank/payment, password manager, primary social.

What password habits actually hurt?

(1) "Base + site name" patterns (Passw0rd!-taobao) — pattern rules get reverse-engineered from any two leaks; (2) forced rotation myths — NIST now advises AGAINST arbitrary 90-day changes (they breed "Summer2025!" increments); change on suspicion of breach instead; (3) security questions with real answers (your mother's maiden name is on social media — lie and store the lie); (4) writing passwords in phone notes (unencrypted, synced everywhere); (5) sharing streaming logins via plaintext chat; (6) trusting "this site hashes passwords, I can tell" — assume every site will be breached; unique passwords make breaches boring.