Key Takeaways
Strong Password
A strong password is one that is genuinely difficult for both automated programs and human guessers to figure out. It achieves this through length, unpredictability, and by being used on only one account. It is not simply about including a symbol or a capital letter — it is about how much effort an attacker would need to crack it.
Security researchers measure password strength using 'entropy' — a mathematical measure of unpredictability. The higher the entropy (driven primarily by length and character variety), the longer a brute-force attack takes.
Why Most Passwords Fail
Most people know passwords matter. Yet common choices like 123456, password, or Summer2023! appear on breached-data lists by the millions. The problem is not that people are careless — it is that the conventional advice (add a capital, add a number, add a symbol) has been misunderstood as sufficient. It is not.
Attackers do not sit at a keyboard guessing manually. They use software that can test billions of combinations per second, along with lists of every password ever leaked in a data breach. If your password follows a predictable human pattern — a word with a number tacked on, a name with a birthday — automated tools will find it quickly.
Understanding what actually makes a password strong starts with understanding how it gets broken.
Top 10
Most common passwords still in use globally
According to NordPass's annual password study, '123456' and 'password' consistently rank among the most frequently used passwords found in breach databases.
~1 second
Time to crack an 8-character common password
Security firm Hive Systems estimates that with current GPU hardware, many 8-character passwords composed of common patterns can be cracked in under a second.
15 billion+
Stolen credentials circulating online
Cybersecurity researchers at Digital Shadows reported over 15 billion stolen usernames and passwords available on criminal forums, underscoring why password reuse is dangerous.
The Four Pillars of a Strong Password
1. Length
Length is the dominant factor. Each additional character multiplies the number of combinations an attacker must try. A 12-character password has astronomically more possible combinations than an 8-character one, even using the same set of characters. Aim for at least 16 characters — and longer is always better.
2. Randomness
Human-chosen passwords are rarely random. We pick words we know, dates that matter to us, and patterns that feel unique but are actually common (like replacing 'a' with '@'). Genuine randomness — ideally generated by a computer — removes predictable structure entirely. A randomly generated string like mX7#kpL2vQ9w has no pattern for an attacker to exploit.
3. Character Variety
Using a mix of uppercase letters, lowercase letters, numbers, and symbols expands the pool of possible characters at each position. This increases what security professionals call entropy. However, character variety cannot compensate for being too short — a four-character password using every character type is still trivially cracked.
4. Uniqueness
A strong password used on ten sites is actually ten weak passwords. When any one of those sites suffers a breach, that password — no matter how complex — is compromised everywhere it was used. Each account deserves its own distinct password. See our guide to password managers for a practical way to manage dozens of unique passwords without memorizing them all.
What Weakens a Password
Certain choices make passwords easy to crack even when they look complex on the surface:
- Personal information: Names of family members, pets, sports teams, or birthdays are among the first things targeted in a targeted attack and are easily found through social media.
- Dictionary words: Single common words — even obscure ones — fall quickly to dictionary attacks.
- Predictable substitutions: Replacing 'o' with '0' or 'e' with '3' is so well-known that attack tools account for it automatically.
- Short length: Any password under 12 characters is at meaningful risk from modern hardware, regardless of its complexity.
- Keyboard patterns: Strings like
qwerty,zxcvbn, orasdfghare on every attacker's list.
Try a Random Passphrase
Pick four or five completely unrelated words at random — not a phrase you know, but words like 'cloud,' 'hammer,' 'envelope,' and 'river.' Strung together with hyphens or spaces, this creates a password that is both very long and structurally unpredictable. It is also far easier to type than a string of random characters.
A random passphrase — four or more unrelated words strung together — can sidestep most of these traps. It is long, memorable, and structurally unpredictable.
Putting It Into Practice
Knowing the theory is only half the challenge. Applying it to every account you own is the other half. A password manager solves this by generating and storing truly random, unique passwords for each site — you only need to remember one strong master password.
Strong passwords are also just one layer of protection. Even the most robust password can be exposed in a site breach you have no control over. That is why pairing strong passwords with two-factor authentication significantly raises the bar for any attacker.
Your email account deserves special attention. It acts as a recovery key for nearly every other account you own. Learn more in our article on why your email inbox is a target. For a broader look at staying safe online, see our guide on digital security habits that hold up over time.