Why a long password beats a complicated one

P@ssw0rd! ticks every box: uppercase, lowercase, number, symbol, eight characters. Any form accepts it as a “strong password”.

It’s one of the worst passwords in existence. It sits near the top of every attack dictionary, because the obvious substitutions — a for @, o for 0, s for $ — have been the first thing anyone tries for decades.

Meanwhile correct horse battery staple meets none of the requirements and is astronomically more resistant.

Where those rules came from

In 2003, Bill Burr wrote a document for the US standards institute containing the recommendations we all know: mix character types, and change it every ninety days.

In 2017, by then retired, he publicly said he’d got it wrong. That same year the institute rewrote its guidance and dropped both the character-mixing requirement and periodic rotation.

The reason wasn’t theoretical. It was observing what people actually do with those rules:

• They put the capital on the first letter
• They put the number at the end, usually 1 or the year
• They put the symbol after that, usually !
• When forced to change, they go from Summer2024! to Summer2025!

The rules didn’t increase real variety. They pushed everyone towards the same predictable pattern, which is exactly what an attacker exploits.

What actually measures strength

The concept is entropy: how many combinations someone who knows nothing about your password would have to try.

It depends on two things: how many different symbols you can use, and how many positions there are. Length weighs far more, because it enters as an exponent.

Password	Length	Resistance
P@ssw0rd!	9	In the dictionaries: minutes
Tr0ub4dor&3	11	Known pattern: hours to days
my dog is called thomas	23	Enormous
xk29fjqlm	9	High, but impossible to remember

Adding an unusual symbol multiplies the combinations by a few dozen. Adding four more characters multiplies them by millions. That’s why length always wins.

With one important caveat: length only counts if the content is unpredictable. passwordpasswordpassword is long and worthless.

Phrases, not words

The practical answer is several random words. Four or five ordinary words picked without any criterion give a stronger password than almost anything twelve characters long with symbols — and you can actually remember it.

Two conditions:

Genuinely random. Not a song lyric, not a proverb, not a film title. Attack dictionaries include set phrases and lyrics. Randomness is what makes it work.

Independent of each other. dog cat hamster canary is worse than it looks, because they’re all from one category and that shrinks the search space.

The real problem isn’t this

Here’s the uncomfortable part: for important accounts, your password’s strength is almost never what fails.

Serious services rate-limit attempts: after a few failures, they lock. Nobody is going to try millions of combinations against your bank’s login form.

What happens in practice is different:

Breaches. Someone gets into some service and takes the database. If your password was in it, its complexity is irrelevant: they already have it.

Reuse. And this is the serious one. With that leaked password they try your email and the same key on fifty other services. If you reused it, they get into all of them. It’s called credential stuffing and it’s by far the most common route in today.

Phishing. You hand it over yourself on a page imitating the real one. The strongest password in the world, typed in the wrong place, is worth zero.

Against these three, password complexity barely helps.

What does work

A different password per service. This is the highest-return measure by a wide margin. It turns a breach into an isolated problem instead of a cascade.

It’s impossible to do by hand, hence the next point.

A password manager. It generates long random keys, stores them encrypted, and fills them in only on the correct domain. That last detail is a real defence against phishing: if you’re on mybank-secure.com, the manager offers nothing, and that absence is a signal.

You remember one master password, which should be long and unique.

With a manager, the whole debate about memorable passwords disappears: you don’t have to remember any of them.

When to change them

You no longer need to rotate every three months. That practice only got people making trivial variations of the previous one.

Change it when there’s a reason:

• The service announces a breach
• You suspect someone saw it
• You used it on a computer you don’t control
• It shows up in a leaked-credentials warning

Modern browsers warn you if a saved password appears in a known breach. Worth having switched on.

The summary

Long beats complicated. Different everywhere beats both.

If you do one thing after reading this, install a password manager and change your email password to something long and unique. Email is the master account: whoever controls it can reset the password on almost everything else.

That’s where to start.