What Actually Makes a Password Strong (It's Not What Most Rules Suggest)

Most people have internalized password requirements shaped by decades of platform-enforced rules: at least one uppercase letter, one number, one special character, a minimum length often set fairly short. What's less widely understood is that actual security research has moved considerably past this model, and some of the most emphasized traditional rules turn out to matter less than a simpler factor that gets comparatively less attention: length.

Why length matters more than complexity rules typically suggest

The security of a password against a brute-force attack (an attacker systematically trying possible combinations) is fundamentally a function of how many possible combinations exist that need to be tried before finding the correct one. Length increases this number of possible combinations exponentially, far more dramatically than adding complexity requirements to a short password does. A longer password made of simple, memorable words is often mathematically stronger against brute-force attack than a shorter password packed with special characters, even though the shorter one feels more complex and secure.

This finding, now widely accepted in security research and reflected in updated guidance from major security organizations, represents a genuine shift from the traditional complexity-focused model many platforms and users still operate under.

Why traditional complexity rules can actually backfire

A counterintuitive but well-documented finding: strict complexity requirements often lead users toward predictable patterns that satisfy the rule's letter while providing limited actual security benefit — capitalizing the first letter, adding a single number or exclamation point at the end, substituting a zero for the letter O. These patterns are common enough that they're specifically accounted for in modern password-cracking approaches, meaning the complexity requirement's actual security benefit is often smaller than intended, while the requirement itself makes passwords harder to remember, which in turn often pushes people toward reusing the same password across multiple accounts — a genuinely more consequential security problem than password complexity, as covered in our companion piece on data breach response.

The passphrase approach

A commonly recommended alternative, following from the length-matters-most principle: a passphrase made of several random, unrelated words strung together, rather than a single shorter word made "complex" through substitutions and additions. A passphrase of several genuinely random words is both easier to remember (since it can be visualized or recited, unlike a string of substituted characters) and mathematically stronger against brute-force attack, due simply to its greater length.

The important caveat: the words need to be genuinely randomly selected, not a predictable phrase or sentence someone might guess (a famous quote, a common saying), since predictability, not just word count, still matters for actual security.

Why unique passwords per account matter more than any single password's individual strength

As emphasized in our companion piece on data breaches, password reuse across multiple accounts is arguably a more consequential security weakness than any individual password's strength, since a single breach exposing a reused password compromises every account sharing it, regardless of how individually strong that password was. This is part of why security guidance increasingly emphasizes using a password manager to generate and store unique passwords per account, rather than relying purely on memorized password strength across many accounts, which becomes impractical to do well without some tool assisting.

Why a password manager changes the entire calculation

Using a password manager removes the practical tension between password strength and memorability entirely — since the manager generates and stores complex, unique, lengthy passwords for each account without requiring you to remember any of them individually (beyond the single master password protecting the manager itself, which should specifically follow the length-focused passphrase approach, since it's the one password you do need to remember and type manually). This single tool adoption arguably does more for overall account security than any amount of individual password-strengthening effort applied without it.

What this means practically, given the above

For a password you'll actually type and remember (like a password manager's master password), prioritize length through a genuinely random passphrase over forced complexity substitutions.

For every other account, use a password manager to generate and store long, random, unique passwords you never need to memorize or type manually.

Don't assume a platform's specific complexity requirements represent optimal security guidance — many platforms still enforce older-style rules (mandatory special characters, shorter maximum or minimum lengths) that reflect outdated conventions rather than current security research, and following a platform's minimum requirement doesn't necessarily mean the resulting password is actually well-optimized for security.

Why this connects to two-factor authentication

Even an excellent password remains a single point of failure on its own, which is why the password-strength conversation and the two-factor authentication conversation, covered in a companion piece, are complementary rather than substitutes for each other — a strong, unique password meaningfully reduces the chance of compromise, while two-factor authentication provides protection even in the event a password is compromised despite best efforts.

The bottom line

Password strength is genuinely better understood through length and uniqueness than through the traditional complexity-substitution model many platforms and users still default to. A passphrase approach for passwords you need to remember, combined with a password manager for everything else and two-factor authentication layered on top, reflects current security understanding considerably better than the inherited conventional wisdom most people still operate from.