Random strings are the most secure passwords — but passphrase techniques and password managers make strong security practical for real people. Here's the science behind password strength and the methods that actually work.
Password security advice has been wrong for decades. The traditional guidance — use uppercase, lowercase, numbers, and symbols; change your password every 90 days; never write it down — was based on intuition rather than research. In 2017, NIST (the National Institute of Standards and Technology) published updated digital identity guidelines that reversed most of this advice, based on actual analysis of how passwords get cracked and how people actually behave when forced to follow complex rules.
What makes a password strong: length is the single most important factor. A 20-character password of random lowercase letters is stronger than an 8-character password with uppercase, numbers, and symbols. This is because password strength is measured in entropy — the number of possible combinations an attacker must try. Each additional character multiplies the search space exponentially. An 8-character password with full character complexity has roughly 200 trillion possible combinations. A 20-character lowercase password has over 19 septillion — nearly 100,000 times more.
What makes a password weak: predictability. Password-cracking tools don't try random combinations — they use dictionaries of common passwords, words, names, and patterns. 'Password1!' is in every cracking dictionary. 'P@ssw0rd' is in every cracking dictionary. 'Summer2024!' follows a pattern (season + year + symbol) that cracking tools are specifically designed to exploit. Substituting letters with numbers (a→4, e→3, o→0) provides almost no additional security — these substitutions are so common that they're built into cracking tools as standard transformations.
The passphrase approach: NIST now recommends passphrases — sequences of random words — as a practical alternative to random strings. A passphrase like 'correct-horse-battery-staple' (from the famous XKCD comic) is both memorable and strong: four random common words create roughly 44 bits of entropy, equivalent to a random 8-character password with full complexity. Five or six random words (generated by a tool like Diceware or 1Password's word generator) provide 60+ bits of entropy — strong enough for most purposes. The key word is random: 'ilovemydog' is not a passphrase, it's a predictable phrase.
NIST's updated guidance on what NOT to do: don't require periodic password changes unless there's evidence of compromise (forced rotation leads to predictable patterns like 'Password1', 'Password2'); don't require complex composition rules (they produce predictable workarounds); don't use security questions (mother's maiden name, first pet — this information is often publicly available or guessable); and don't use SMS for password reset if you can avoid it (SIM swapping attacks can intercept SMS codes).
The practical recommendation: use a password manager to generate and store truly random passwords (20+ characters) for every account. For the handful of passwords you must memorize — your password manager master password, your device login, your primary email — use a 6-word Diceware passphrase. For your password manager master password specifically, make it a 7-word passphrase and never store it anywhere digital. Write it on paper and keep it somewhere physically secure. This approach gives you maximum security with minimum memorization burden.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.