How password strength actually works: entropy, not complexity theater

Most password advice you have received — "one uppercase, one number, one symbol, change it every 90 days" — is complexity theater. It produces passwords like P@ssw0rd1! that satisfy every checkbox and fall in seconds. What actually determines whether a password survives an attack is a measurable quantity: entropy.

Entropy: the honest measure

Entropy measures how many guesses an attacker needs, expressed in bits. Each additional bit doubles the number of possibilities. For a password of length L drawn randomly from a character set of size N, the entropy is:

entropy = L × log₂(N)

Some real character-set numbers: lowercase letters give log₂(26) ≈ 4.70 bits per character; adding uppercase (52 characters) gives 5.70; adding digits (62) gives 5.95; the full printable-symbol set (~95 characters) gives about 6.57 bits per character.

Now compare two policies:

• 8 characters, all four character classes: 8 × 6.57 ≈ 52.6 bits
• 16 characters, lowercase only: 16 × 4.70 ≈ 75.2 bits

The lowercase-only password is roughly 6 million times harder to brute-force, and it is also easier to type. Length wins because it multiplies entropy, while widening the character set only nudges the per-character figure. Growing the charset from 26 to 95 characters adds about 40% per character; doubling the length adds 100%.

One critical caveat: the formula only holds for randomly generated passwords. correcthorse typed by a human is not 12 random lowercase characters, because humans pick words. Attackers know this and guess dictionaries, keyboard walks, dates and mutations (password → P@ssword2024!) long before they resort to raw brute force. This is why strength meters that just count character classes mislead you, and why the only password whose entropy you can trust is one a generator produced.

How fast attacks actually are

Entropy only means something relative to guessing speed, and guessing speed depends entirely on where the attack happens.

Online attacks hit the login form of a live service. Any competent service throttles or locks accounts, holding attackers to perhaps 10–100 guesses per second at best — often far fewer. Against online attacks, even a modest password holds.

Offline attacks are the real threat. When a service is breached and its password database leaks, attackers take the stolen password hashes home and guess at hardware speed. A single modern GPU computes on the order of tens of billions of MD5 or NTLM hashes per second — call it 10¹⁰ to 10¹¹ guesses per second — and a cracking rig with eight GPUs multiplies that again.

Run the numbers at 10¹⁰ guesses per second:

Entropy	Example	Average time to crack (fast hash)
40 bits	6 random mixed chars	under 1 minute
52 bits	8 chars, all classes	~3 days
66 bits	10 random mixed chars	~117 years
77 bits	6-word Diceware passphrase	~240,000 years

Well-run services blunt this by hashing with deliberately slow, memory-hard functions — bcrypt, scrypt or Argon2 — which cut guessing rates from billions per second to thousands. But you rarely know how a given site stores your password, and breach history says many store it badly. Plan for the worst case: assume offline, assume a fast hash.

The uncomfortable truth: uniqueness beats strength

Here is the part that matters more than any of the maths above. The most common way accounts are compromised is not cracking at all — it is credential stuffing: attackers take the billions of email-and-password pairs already circulating from old breaches and replay them against other sites. If you reused a password, its strength is irrelevant; the attacker is not guessing, they are logging in.

A unique random password per site converts every breach from a master key into a contained incident. This single change does more for your security than any strength rule.

Passphrases: strength you can remember

For the handful of passwords you must actually memorise — your computer login, your password manager's master password — random character strings are hostile. Passphrases solve this. The Diceware method selects words at random from a list of 7,776 words, giving log₂(7776) ≈ 12.9 bits per word. Six words ≈ 77.5 bits: stronger than a 12-character random-symbol password, and you can hold it in your head.

The rule again: the words must come from random selection (dice, or a generator), not from your own head. A quotation or song lyric is in every cracking dictionary.

The practical setup

1. Use a password manager. It generates and remembers a unique random password per site, which solves strength and uniqueness at once. The residual risk of one basket-of-eggs is far smaller than the certainty of reuse without one.
2. Make the master password a 5–6 word random passphrase. It is the one password that must be both strong and memorable.
3. Turn on two-factor authentication where offered — it holds the line when a password fails anyway.
4. Stop rotating passwords on a schedule. Current NIST guidance (SP 800-63B) explicitly recommends against forced periodic changes, because they push people toward predictable patterns; change a password when there is evidence of compromise.
5. Length over ceremony. Given the choice, a longer simpler password beats a shorter ornate one, every time — the maths is not close.

Entropy is not a vibe; it is arithmetic. Once you can do the arithmetic, most password folklore evaporates, and what remains fits in the five points above.