The rules most sites still enforce, one uppercase letter, one digit, one symbol, change every 90 days, were written from intuition rather than evidence. The organisation that published them has since withdrawn the advice, and the reason it withdrew it explains what actually makes a password hard to crack.
Entropy Is the Only Number That Matters
Password strength is measured in bits of entropy, which is a statement about how many guesses an attacker needs. Each additional bit doubles that number.
The formula is straightforward: entropy equals length multiplied by the base-2 logarithm of the alphabet size. An alphabet of lowercase letters alone gives 4.7 bits per character. Adding uppercase gives 5.95. Adding digits and symbols brings it to about 6.55 bits per character.
So a symbol buys you roughly 1.8 bits over a lowercase-only alphabet. One extra character buys you 4.7 bits, and it is the same 4.7 whether the alphabet is complex or not. This is the entire argument for length over complexity, and the arithmetic is not close: a 16-character lowercase password has more entropy than a 12-character password using every symbol on the keyboard.
The catch is that this formula only holds for randomly generated passwords. It says nothing about human-chosen ones, because humans do not choose uniformly.
Entropy and Offline Cracking Time
Assumes an offline attack at 10^12 guesses per second against a fast hash such as unsalted SHA-1. Properly configured bcrypt or Argon2 slows this by many orders of magnitude.
| Password | Alphabet | Entropy | Average time to crack |
|---|---|---|---|
| password123 | Dictionary word + digits | ~8 bits effective | Instant; it is in every wordlist |
| Tr0ub4dor&3 | Substituted word | ~28 bits | Minutes |
| 8 random chars, full set | 94 characters | 52 bits | About an hour |
| 12 random chars, full set | 94 characters | 79 bits | About 19,000 years |
| 16 random chars, full set | 94 characters | 105 bits | Beyond practical reach |
| 4 random dictionary words | 7,776-word list | 52 bits | About an hour |
| 6 random dictionary words | 7,776-word list | 78 bits | About 9,000 years |
What NIST Changed, and Why
NIST Special Publication 800-63B, revised in 2017 and reaffirmed since, reversed several rules that had been standard practice for fifteen years.
Composition rules were dropped. Requiring a symbol and a digit produces predictable results: people capitalise the first letter, put the digit and the symbol at the end, and pick `Password1!`. The rule increases the theoretical alphabet while shrinking the space attackers actually have to search.
Periodic expiry was dropped. Forcing a change every 90 days causes people to pick passwords they can increment, so `Summer2025!` becomes `Autumn2025!`. Attackers know this. NIST now recommends changing a password only when there is evidence of compromise.
Blocklists were added. Instead of composition rules, NIST recommends checking new passwords against lists of known-breached values. This targets the real risk, which is reuse of a password that already appears in a public dump.
Length minimums went up, with support for passwords to at least 64 characters and no restriction on which characters are allowed, including spaces and Unicode.
Randomness has to come from the right source
This generator uses the Web Crypto API's getRandomValues, which draws from the operating system's cryptographically secure random source. The alternative, Math.random, is a fast pseudo-random generator whose output is predictable if you can observe enough of it. It is fine for shuffling a carousel and unfit for generating a secret.
What Actually Protects an Account
Password strength is one control among several, and it is not the one that fails most often.
Never reuse a password
Credential stuffing, replaying a breached pair against other sites, succeeds far more often than cracking. A unique password per site means one breach costs you one account rather than all of them.
Turn on two-factor authentication
An authenticator app or hardware key defeats a stolen password outright. Prefer app-based or hardware codes to SMS, which is vulnerable to SIM swapping.
Use a password manager
It is the only practical way to hold a hundred unique random passwords. The manager's own master password should be a long passphrase you can remember and have never used elsewhere.
Protect the email account first
Email is the reset path for everything else, which makes it the highest-value target. It deserves your longest password and your strongest second factor.
Check your addresses against breach data
Have I Been Pwned lists addresses that appear in public dumps. If one of yours is there, change that password and anywhere you reused it, in that order.
Generate a strong password
Cryptographically secure randomness with a live entropy readout, generated in your browser and never transmitted.
Passphrases and the Correct Horse
The well-known xkcd comic argues that four random common words beat a short scrambled password, and the arithmetic supports it. Four words drawn randomly from a 7,776-word list give about 52 bits, the same as eight fully random characters, and the words are far easier to remember.
Two conditions have to hold, and both are routinely violated. The words must be chosen randomly, ideally with dice or a generator, not picked by a person. And the list must be large. Four words a human thinks of are not 52 bits; they are closer to 20, because people reach for the same concrete nouns.
Passphrases make sense for the handful of secrets you must type from memory: your device login, your password manager's master password, your disk encryption key. For those, six random words is a reasonable target.
Everything else should be a long random string produced by a generator and stored in a manager, because you never need to remember it and length costs you nothing.
Frequently Asked Questions
Related Tools
Keep Reading
SHA-256 Explained: What Hashes Guarantee and What They Do Not
Three properties make a hash cryptographic, and each one supports a different use. Why SHA-256 is the wrong tool for storing passwords.
MD5 in 2026: Broken for Security, Still Useful for Checksums
Collisions have been practical since 2004 and forged a Microsoft certificate in 2012. Which of MD5's remaining uses that break actually affects.
Base64 Is Not Encryption: What It Does and Why It Exists
Three bytes become four characters, which is where the 33 percent size increase and the trailing equals signs come from. And why it hides nothing.
Why Character Counts Disagree: Emoji, Accents and SMS Segments
One emoji can cost seven characters, and a single curly apostrophe can triple your SMS bill. The three definitions of a character, and when each applies.