The advice you were given for years — use a capital letter, a number, and a symbol — was never about making passwords hard to crack. It was about meeting arbitrary complexity requirements on websites built in 2003. NIST (the U.S. National Institute of Standards and Technology) reversed its own complexity guidance in 2017, acknowledging that requirements like "change your password every 90 days" made security worse, not better. Here is what the evidence actually supports.
What Determines Password Strength
Password strength comes down to entropy — the number of bits an attacker would need to guess to crack it by brute force. Entropy is primarily a function of password length and the size of the character set used. A 12-character password from a 96-character set (lowercase, uppercase, digits, symbols) has ~79 bits of entropy. A 16-character password from the same set has over 105 bits. The difference is enormous in cracking time.
The specific characters matter less than their variety. A 12-character password of all lowercase letters has 56 bits of entropy. Adding uppercase, digits, and symbols to an 8-character password gets you 53 bits. The 12-character all-lowercase password is technically stronger despite seeming simpler — because length compounds exponentially. This is why NIST now recommends prioritizing length over complexity.
Pattern-based complexity is the enemy of real entropy. P@$$w0rd! satisfies every complexity requirement: uppercase, lowercase, symbol, digit. It is also in every cracking dictionary. Humans create patterns to remember passwords, and attackers know every pattern: letter substitution (a→@, e→3, o→0), appending numbers to words, capitalizing the first letter. These patterns reduce the effective entropy to nearly nothing.
How Modern Password Cracking Actually Works
Attackers almost never brute-force individual characters anymore. They use wordlists combined with rule-based mutation engines like Hashcat. These tools can take a wordlist of 10 million common passwords and apply thousands of variations — leetspeak substitutions, appended years, reversed words — testing billions of combinations per second on modern GPUs.
When a service is breached, attackers get hashed passwords. They then run their cracking tools offline against the hashes, matching candidates against the hash until they find the original password. In 2025, a well-equipped attacker can test 100 billion bcrypt hashes per second with multiple GPUs. This means that weak or patterned passwords are cracked within hours of a breach.
Credential stuffing is a different but equally dangerous attack: attackers take username/password pairs from one breach and try them on every major service. If you reuse passwords, a breach at one site compromises all your accounts. The 2024 RockYou2024 credential dump contained 10 billion unique username-password pairs from thousands of previous breaches.
Passphrases: When They Work and When They Do Not
A passphrase — four or more random words strung together, like "correct-horse-battery-staple" — can be stronger than a traditional complex password while being far more memorable. The key word is random. "I love my dog Max" is not random — it is constructed from patterns (subject, verb, object, name) that attackers model. True random selection of words from a large wordlist (the Diceware method) produces high entropy.
A four-word random passphrase from a 7,776-word list has about 51 bits of entropy — less than a 12-character random password. Five words give 64 bits, and six words give 77 bits. Passphrases work best for high-stakes accounts where memorability matters (full-disk encryption password, main email account) and where you cannot use a password manager.
For everything else — the 50+ accounts the average person maintains — passphrases are impractical to generate and remember. The realistic solution is a random password generator paired with a password manager, where you only need to remember one strong master passphrase.
What to Do Right Now
Install a password manager. 1Password, Bitwarden (open source), and Dashlane are well-audited options. A password manager generates a unique, random, high-entropy password for every account and stores it encrypted. You only memorize one strong master password. This single change eliminates credential stuffing as a threat against you.
Enable two-factor authentication (2FA) on every account that offers it, prioritizing email, banking, and work accounts. Even if an attacker knows your password, 2FA requires a second factor — an authenticator app code, a hardware key, or a push notification — to log in. Authenticator apps (Google Authenticator, Authy) are more secure than SMS 2FA, which is vulnerable to SIM-swap attacks.
Check if your existing passwords have been compromised using HaveIBeenPwned.com. The service cross-references your email against 12+ billion breached credentials. Any account where your password appears in a breach should be changed immediately, and the new password should be unique — generated by your password manager, not created by you.
The most important security upgrade you can make today costs nothing and takes 20 minutes: install a password manager and let it replace your existing passwords with randomly generated ones. The advice to "use a symbol and a capital letter" was always theatrical — it checked boxes without actually improving security. Length, randomness, and uniqueness are what matter. A password generator removes the human bias that attackers exploit and provides the kind of entropy that makes brute force attacks computationally infeasible.