What actually makes a password strong
The rules most of us learned — a capital, a number, a symbol — optimise for looking complicated to a human. Attackers are not human, and they are not fooled.
Entropy is the actual measure
Password strength is measured in bits of entropy, which is a statement about how many guesses an attacker would need. Each additional bit doubles that number. The calculation is straightforward: the size of the character set raised to the power of the length, expressed as a logarithm base two.
An eight-character password using lowercase letters only has about 38 bits. Adding uppercase, digits and symbols pushes the same length to roughly 52 bits. But extending the lowercase-only password to sixteen characters gives about 75 bits — far stronger than the short complex one. Length contributes exponentially; character variety contributes linearly.
Why substitutions do not help
Replacing letters with lookalike characters feels like it adds difficulty, and against a person reading over your shoulder it does. Against software it adds almost nothing, because every cracking tool has applied those substitution rules as standard for decades. A dictionary word with predictable replacements is tested in the same pass as the plain word.
The same applies to appending a digit and an exclamation mark to satisfy a complexity rule, capitalising the first letter, or adding the current year. These are the most predictable modifications there are, and the attacker's rule set covers them before it tries anything genuinely random.
Passphrases and why they work
Four or five random words produce a password that is long, high-entropy and actually memorable. The critical requirement is that the words are chosen randomly, not by you — human-chosen words follow patterns and cluster around common vocabulary, which collapses the search space dramatically.
Randomly selecting five words from a list of eight thousand gives about 64 bits, and the result is something a person can hold in their head. A phrase from a book, a song lyric or a familiar saying gives almost none, because the attacker's corpus already contains it.
Reuse is the risk that actually gets people
Most accounts are not lost to brute force. They are lost because a password was reused on a service that suffered a breach, and attackers now take credentials from one breach and try them everywhere else — a technique called credential stuffing. It works constantly, and the strength of the password is irrelevant when the attacker already has it.
This is why a password manager matters more than any rule about composition. It makes every password unique and long without requiring you to remember any of them, and it turns a single breach into a single-account problem.
How the advice changed
Guidance from major standards bodies has shifted markedly. Forced periodic expiry is now discouraged, because it pushes people toward predictable incremental variations — the same password with a rising number on the end. Composition rules are discouraged for the same reason: they narrow the space of what people choose.
What is recommended instead is a generous minimum length, permitting very long passwords and all characters including spaces, and screening new passwords against lists of known-breached ones. The emphasis moved from making passwords look complicated to making them long, unique and not already public.
What a strong password does not protect you from
Phishing bypasses password strength entirely — if you type it into a convincing fake, its entropy is irrelevant. So does malware that reads keystrokes, and so does a breach of a service that stored passwords carelessly.
This is the case for two-factor authentication, which changes the failure mode: an attacker with your password still cannot get in. An authenticator app or hardware key is meaningfully stronger than SMS, which is vulnerable to number-porting attacks. A long unique password plus a second factor covers nearly every realistic threat.