Password Security in 2026: Why Length Beats Complexity

Why “complex” passwords often fail

For years, password rules demanded an upper-case letter, a digit and a symbol. People responded predictably: they wrote Password1!, swapped a for @, or added a number at the end. Attackers know these patterns, and their cracking tools try them first.

Current guidance, including NIST’s digital identity guidelines (SP 800-63B), moved away from forced composition rules and routine forced password changes. It favours long passwords, allows long inputs, and recommends checking new passwords against lists of already-breached ones. The reason is simple: strength comes from how many guesses an attacker needs, and length multiplies that number much faster than symbols do.

Entropy: the number that actually matters

Entropy, measured in bits, estimates how unpredictable a password is. Every extra bit doubles the guesses needed. A password like Tr!7 looks complex but is tiny, so it has very little entropy. Length wins because each added character or word multiplies the possibilities.

Here is a useful rule of thumb. If you pick words randomly from a list of 7,776 words (the Diceware method), each word adds about 12.9 bits. Four words give roughly 51 bits, five give about 65, and six give about 78. A phrase you invent from a song lyric or a quote is much weaker, because attackers can guess human-chosen phrases. The key word is random.

My password strength checker on the Tools page estimates entropy rather than just counting symbols, and it runs entirely in your browser, so nothing you type is uploaded.

How to build a strong passphrase

1. Choose 4–6 unrelated words using dice or a password manager’s generator, not words that mean something to you.
2. Separate them with a hyphen or space if the site allows it, which also makes them easier to type.
3. Skip personal details such as birthdays, pet names and usernames.
4. Use a password manager for everything else, so “unique and long” never means “impossible to remember.”

You only need to memorise a few passphrases: your password manager’s master password and your email account, for example. Let the manager generate the rest.

Five habits that matter more than any rule

• One password per account. Reuse is how a breach at one site becomes a breach everywhere (credential stuffing).
• Turn on two-factor authentication. An authenticator app, passkey or hardware key is stronger than SMS codes, but any second factor is better than none.
• Protect your email first. Password resets go to your inbox, so whoever controls it can reach everything else.
• Check for breaches. Services such as Have I Been Pwned can tell you if an address appeared in a known leak, so you know when to change a password.
• Beware phishing. The strongest password is useless if you type it into a fake login page. Check the address bar before signing in.

Keep reading

Related topics on this site

• Cybersecurity services and guidance
• Web development
• Free browser tools
• All articles