Password strength explained: length, entropy and passphrases
A password is only as strong as the number of guesses it takes to find it. Attackers do not read your password and judge it; they try candidates, fastest and most likely first, until one works. This guide covers how that guessing is measured, why adding length helps far more than adding symbols, when a passphrase of plain words is enough, and what the current NIST guidelines expect from the sites that store your password.
How passwords are actually cracked
There are two situations, and they differ by many orders of magnitude.
Online guessing happens against a login form. The site sees every attempt and can slow it down or lock the account: the NIST guidelines require a limit of no more than 100 consecutive failed attempts on one account. Here, only the weakest passwords fall.
Offline cracking happens after a data breach, when the attacker has a copy of the stored password hashes and can test guesses on their own hardware as fast as it runs. A single RTX 4090 graphics card, in the widely cited hashcat benchmark, tests about 164 billion guesses a second against MD5 and about 184 thousand against bcrypt. The difference comes from the site's choice of hash, not from your password — which is why the one thing you control is making the number of candidates too large to search.
Entropy: counting the possibilities
For a password chosen at random, strength is simply the number of possible passwords of that length and character set. It is usually given in bits of entropy: each bit doubles the number of guesses needed.
Entropy = length × log₂(size of the character set)
| Characters drawn from | Set size | Bits per character |
|---|---|---|
| Digits only | 10 | 3.32 |
| Lowercase letters | 26 | 4.70 |
| Upper and lowercase letters and digits | 62 | 5.95 |
| The nTools generator with every set on | 80 | 6.32 |
| All printable characters (letters, digits and every keyboard symbol) | 94 | 6.55 |
“Printable” here means the 94 characters of basic ASCII you can type on a standard keyboard, space excluded: 26 capital letters, 26 small letters, 10 digits and 32 symbols such as ! ? @ # % & *. The nTools generator uses 18 of those symbols, which is why its set is 80 characters.
The formula only holds when every character is picked at random. A password a person invents — a word, a name, a year, a capital at the start and a ! at the end — has far less entropy than its length suggests, because crackers try exactly those patterns first.
Length beats complexity
Adding a character multiplies the work by the whole size of the set; adding a character type only enlarges the set a little. The times below are for trying every possibility on one RTX 4090 against unsalted MD5 — a worst case for the site, and an attacker with eight cards needs an eighth of the time.
| Random password | Entropy | Time to try every one |
|---|---|---|
| 8 lowercase letters | 37.6 bits | about 1.3 seconds |
| 8 letters and digits | 47.6 bits | about 22 minutes |
| 8 characters, all printable | 52.4 bits | about 10 hours |
| 12 characters, all printable | 78.7 bits | about 92,000 years |
| 15 lowercase letters | 70.5 bits | about 320 years |
| 20 characters from the nTools generator | 126.4 bits | far beyond any computer |
Fifteen lowercase letters beat eight characters of every kind by a factor of about a quarter of a million. Symbols are not useless — they help — but a few extra characters help more, and are easier to type on a phone.
Passphrases: random words
A passphrase uses whole words as the “characters”. The EFF long wordlist has 7,776 words, one for every result of five dice, so each word picked at random adds about 12.9 bits. EFF recommends six words for most uses, which gives about 77 bits — close to a 12-character password of every printable character, and much easier to remember and type.
| Random words from the EFF list | Entropy |
|---|---|
| 4 words | 51.7 bits |
| 5 words | 64.6 bits |
| 6 words | 77.5 bits |
| 7 words | 90.5 bits |
The same condition applies: the words must be chosen at random, by dice or a generator. A line from a song or a phrase you made up is not a random passphrase, however long it is.
What the NIST guidelines say
NIST's Digital Identity Guidelines, SP 800-63B, are the reference most security policies follow. The revision published in July 2025 changed several long-standing habits:
- Length: at least 15 characters when the password is the only factor, and at least 8 when it is part of multi-factor authentication. Sites should allow at least 64 characters and accept spaces and Unicode, and must check the whole password, never a truncated part of it.
- No composition rules: sites must not require mixtures of character types, such as “one uppercase letter, one digit, one symbol”.
- No forced changes: sites must not make people change passwords periodically — only when there is evidence the password has been compromised.
- Blocklists: new passwords must be compared against a list of common, expected and breached passwords, and rejected if they appear on it.
- Password managers: sites must allow password managers and autofill, and should allow pasting.
- No hints or security questions: no stored hints visible to anyone, and no “name of your first pet” questions.
How sites should store passwords
A site should never store your password itself, only a hash of it: a one-way fingerprint that can check a login but cannot simply be reversed. Fast general-purpose hashes such as MD5 or SHA-256 are the wrong tool, because they let a stolen database be attacked at billions of guesses a second. Password-hashing functions such as bcrypt, scrypt and Argon2 are deliberately slow and use a unique random salt for every password, which is what cuts the attacker's speed from billions to thousands.
You cannot see which one a site uses. That is the practical reason to assume the worst and choose a password that would survive even the fast case.
Keeping it simple in practice
- Use a password manager. It makes a long random password for every site as easy as a short one, and it fills in only on the real site, which also protects against phishing pages.
- Never reuse a password. When one site is breached, attackers try the same email and password everywhere else.
- Turn on a second factor — or use passkeys where a site offers them — for email, banking and anything that can reset your other accounts.
- Check whether a password has leaked. Have I Been Pwned's Pwned Passwords service checks it without receiving it: only the first five characters of its SHA-1 hash leave your device.
- Memorise only a few. The password manager's master password and your main email account are the ones worth a six-word passphrase.
Frequently asked questions
Is a 12-character password long enough?
If it is random and drawn from every printable character, it has about 79 bits and is out of reach of offline search. If a person chose it, it may be far weaker. NIST now asks for 15 characters when a password is the only factor.
Does replacing letters with symbols (P@ssw0rd) help?
Hardly. Cracking tools apply these substitutions automatically, and P@ssw0rd is in every list of common passwords. Randomness and length are what count.
Should I change my passwords regularly?
No, unless there is a reason to think one has leaked. Scheduled changes push people towards predictable patterns such as adding a number at the end, which is why NIST no longer allows sites to require them.
Is it safe to use an online password generator?
Only if the password is created on your device and never sent anywhere. The nTools generator runs entirely in your browser and uses its cryptographic random number generator; nothing is uploaded.