What Makes a Password Secure? Strength, Entropy, and Best Practices

“Must contain 8 characters, an uppercase letter, a number, and a symbol.” Almost every website has shown you some version of this rule, and for years it was treated as the definition of a strong password. Modern guidance has moved on. This article explains what actually makes a password secure, why the old complexity rules mislead people, and what to do instead.

Strength is math, not rules

A password’s strength is measured in entropy — the number of guesses an attacker would need to try in a brute-force attack. Entropy is measured in bits: each bit doubles the search space. A password with 40 bits of entropy has roughly 2^40 (a trillion) possible values; one with 60 bits has 2^60 (a quintillion).

Entropy comes from two sources:

• The size of the character set (the pool each character is drawn from).
• The length of the password.

The formula is straightforward: entropy = length × log2(charsetSize). A 12-character password drawn from 62 characters (lowercase + uppercase + digits) has about 71 bits of entropy. The same 12 characters drawn from 94 characters (adding symbols) has about 78 bits.

Here is the crucial insight: length contributes far more entropy than symbol variety. Adding one character to a 62-character-set password adds about 5.95 bits. Switching from a 62-character set to a 94-character set adds about 0.6 bits per character. A 16-character alphanumeric password is stronger than an 8-character password full of symbols.

Why the old rules failed

The traditional rules (“one uppercase, one number, one symbol”) were an attempt to increase the character set. But human behavior defeated them. Faced with the rules, people chose predictable patterns: Password1!, Summer2024!, Admin@123. These satisfy the rules but have almost no entropy, because they follow templates that attackers know to try first.

The rules also made passwords harder to remember without making them meaningfully harder to crack, which pushed people to reuse the same “complex” password across every site — the single biggest security mistake you can make.

What modern guidance says

NIST’s current guidance (since 2017) and most security experts now recommend:

• Length over complexity. Prefer longer passwords (16+ characters) over shorter ones packed with symbols. Length adds more entropy per keystroke and is easier to remember as a passphrase.
• No mandatory composition rules. Do not force users to include specific character types. Let them choose length and content freely.
• No forced rotation. Periodic password changes lead to weaker passwords (Winter2024! → Spring2024!), not stronger ones. Change only on suspected compromise.
• Screen against common passwords. Reject passwords found in breach dictionaries (password, 123456, qwerty).
• Use a password manager. The only way to have a unique, strong password for every account is to let a computer generate and remember them.

The passphrase alternative

For passwords you must remember (like a password manager’s master password), a passphrase of four or five random common words is both stronger and easier to remember than a short complex password. A four-word passphrase from a 2000-word vocabulary has about 44 bits of entropy and is trivial to remember (correct-horse-battery-staple); an 8-character password with symbols has about 52 bits and is hard to remember. The passphrase wins on usability for nearly equivalent strength.

Why you need a password manager

You cannot remember a unique strong password for every account — the average person has dozens to hundreds of accounts. A password manager solves this by generating a strong, unique, random password for each site and storing them encrypted behind a single master password (or passphrase) that you remember.

This is the single most impactful security habit available to an individual. With a password manager:

• Every site gets a unique, 20+ character random password.
• A breach on one site does not compromise any other.
• You only remember one strong passphrase.

Generate strong random passwords with the Password Generator, which uses the browser’s cryptographic random source (not Math.random()).

Why generated passwords must use a CSPRNG

A password is only as random as its source of randomness. Math.random() in JavaScript is fast but predictable — it is a pseudo-random number generator (PRNG) designed for speed, not security, and its output can be predicted from enough observed values. For passwords you must use a cryptographically secure PRNG (CSPRNG) such as the Web Crypto API’s crypto.getRandomValues. A CSPRNG is designed so that its output cannot be predicted even if you observe previous outputs. The Password Generator uses crypto.getRandomValues for exactly this reason.

Storing passwords (server-side)

If you build a system that stores passwords, the rules are different from choosing them. Never store passwords in plaintext, and never hash them with a plain fast hash like SHA-256. Use a dedicated password-hashing function — bcrypt, scrypt, or Argon2 — that is deliberately slow and salted, so that a stolen database cannot be cracked at billions of guesses per second. Read the MD5 vs SHA-256 guide for the full explanation of why.

The summary

• Length beats complexity. Prefer 16+ characters.
• Randomness beats patterns. Use a generator, not Password1!.
• Unique per site. A password manager makes this practical.
• CSPRNG, not Math.random. Cryptographic randomness is non-negotiable for passwords.
• Hash, don’t encrypt, on the server. Use bcrypt or Argon2.

Generate your next password with the Password Generator — 16 characters, all character types, cryptographically random, and never transmitted anywhere.