What actually makes a password hard to crack

Almost every password rule you have been given optimises for the wrong thing. "One uppercase, one number, one symbol" produces passwords that are hard for humans to remember and easy for machines to guess. The reason is worth understanding, because it changes what you should actually do.

What an attacker is really doing

Nobody is typing guesses into a login form. The realistic attack is offline: a database of password hashes leaks, and the attacker runs guesses against it on their own hardware, as fast as their machine allows. There is no rate limit and no lockout, because your server is not involved.

And they do not start with aaaaaa. They start with the hundred million passwords that have appeared in previous breaches, then dictionary words, then those words with predictable modifications applied. Brute force — trying every possible combination — is the last resort, not the first.

That ordering is the key to everything else.

Why P@ssw0rd1! is not a strong password

It satisfies every rule: uppercase, lowercase, number, symbol, nine characters. It is also one of the first things any cracking tool tries.

The reason is that cracking tools apply rules to dictionary words: replace a with @, replace o with 0, capitalise the first letter, append a digit, append an exclamation mark. Those substitutions are so universal that they are built into the standard rule sets. Applying them multiplies the search space by a tiny factor — maybe a few hundred — against a dictionary of a few hundred thousand words. That is a trivial amount of extra work.

You feel like you have made the password much harder. You have made it a few hundred times harder, against an attacker doing billions of guesses a second.

The maths: entropy

Password strength is measured in bits of entropy, and the formula is: bits = length × log2(size of the character set).

The important part is where each variable sits. The character set is inside a logarithm — expanding it gives you diminishing returns. Length is a plain multiplier.

• Lowercase only (26 characters) is 4.7 bits per character.
• Adding uppercase (52) takes it to 5.7.
• Adding digits (62) takes it to 5.95.
• Adding symbols (95) takes it to 6.55.

So going from lowercase-only to the full printable set — every rule your bank insists on — gains you about 1.85 bits per character. Adding two more characters to a lowercase password gains 9.4 bits. Two extra characters beat every symbol rule combined, several times over.

An 8-character password using all 95 printable characters is about 52 bits. A 12-character lowercase-only password is about 56 bits. The second one is stronger, and it is far easier to type.

The passphrase approach

This is the practical consequence. Four or five random words — genuinely random, chosen by something that is not your brain — give you a password that is long, high entropy, and actually memorable.

The critical word is random. "correct horse battery staple" is famous, which means it is in every wordlist, which means it is worthless now. A phrase you compose yourself is not random either: human word choice is heavily biased and follows grammar, and attackers model that.

The entropy comes from a machine picking from a known large list. Five words from a 7,776-word list is about 64 bits — comfortably strong, and you can say it out loud.

Where the numbers come apart

Entropy assumes the attacker knows only the length and character set, and has to search that space. It stops being meaningful the moment the password appears in a breach list, because then it takes one guess regardless of how many bits it theoretically had.

This is why reuse is the real vulnerability, and why it matters more than composition. A 20-character password you also used on a forum that got breached in 2019 offers no protection at all. A mediocre password used in exactly one place is, in practice, safer.

The part that is not your job

How fast an attacker can guess depends on how the site stored your password, which you cannot control and usually cannot find out.

A site hashing with plain SHA-256 lets an attacker try billions of candidates per second on a consumer GPU. A site using bcrypt, scrypt or Argon2 — algorithms designed to be deliberately slow and memory-hungry — cuts that to thousands. The same password can be broken in minutes or hold for centuries depending entirely on a decision someone else made.

You cannot fix that. What you can do is make sure a single site's bad decision does not cost you every other account, which brings it back to the same place: unique passwords, generated rather than invented, long rather than clever.

The short version

• Length beats complexity. It is not close.
• Never reuse. This matters more than everything else here.
• Let a machine generate it. Human-chosen randomness is not random.
• Character substitutions buy almost nothing. Attackers automate them.
• Turn on two-factor authentication where it is offered. It survives a leaked password entirely, which no amount of password strength does.