Password strength is entropy

Every password exists in a search space: the set of all strings an attacker might try. The 'amount of guessing needed' is its entropy, usually measured in bits. A higher-entropy password sits deeper in that space, and each additional bit doubles the work needed to find it. Almost everything useful about password strength reduces to increasing that number.

Entropy in practice: length vs complexity

Entropy grows with the number of choices per position to the power of the length. Adding one character to a length-10 password multiplies the search space by the size of your character set - but adding a second character type only enlarges each position's choices, adding a few bits total. The arithmetic is unambiguous: a password of 16 lowercase characters from a 26-letter alphabet has more entropy than an 8-character password mixing symbols, digits, and cases.

Why cracking hardware changed the rules

Modern cracking rigs test hashes in the billions per second range for common algorithms. An 8-character mixed-class password, once considered strong, sits in a space those machines can exhaust in hours to days. Pushing toward 16 or 20 characters moves the effective effort from hours of GPU time to effectively infinite - the exponential effect of length is the only measure that keeps up with the hardware.

From entropy to a usable rule

  • Generate randomly; do not construct.
  • Target 16 characters minimum for anything protecting real value.
  • Include a wide character set when your generator offers it; it adds modest but real bits.
  • Never reuse a generated password across accounts - reuse collapses all that entropy into a single point of failure.

Passphrases: entropy with a memory hook

Four randomly chosen words from a large wordlist can produce comparable entropy to a short random string, and people can actually remember them. The caveat is word choice: a quoted song lyric, a favorite saying, or a name-plus-numbers pattern is already predictable and appears in cracking dictionaries. Only count the entropy of genuinely random word selection.

Where randomness comes from

The generator is only as secure as its random source. Use a tool backed by a cryptographically secure random number generator, which draws from operating-system entropy rather than the predictable seeds of generic math functions. That guarantee, plus a length in double digits, is what turns 'a password' into no technology that brute force realistically breaks.

The companion controls

Strong passwords do not stand alone. Enable multi-factor authentication wherever it exists, use unique credentials per site, and let a password manager generate, store, and fill them. The math provides the strength; the hygiene makes it hold.