How strong a password needs to be

For an account you would mind losing, use a randomly generated password of at least 16 characters, or a passphrase of at least 5 randomly chosen words, and use it on exactly one site. That is 65 to 95 bits of entropy, comfortably beyond brute force, and the "one site" part matters more than the strength. Below is the reasoning behind those numbers.

Entropy in bits

Entropy measures how many equally likely possibilities the password was drawn from, as a power of two. 40 bits of entropy means one of 2^40 possibilities, about a trillion, and every extra bit doubles the work of guessing it. The formula is bits = length x log2(size of the character set), so lowercase letters are worth 4.7 bits each, letters and digits 5.95, all printable ASCII 6.57, and a word from a 7,776 word list 12.9:

This maths only holds if the password came from an actual random process. Tr0ub4dor&3 is 11 characters from a 95 character set, which the formula scores at 72 bits, but it is a dictionary word with predictable substitutions and a cracking tool reaches it far sooner. Entropy describes the generator, not the string.

What the bits buy you

Guessing speed depends on how the site stored the password. Against a live login form with rate limiting, an attacker gets a few attempts per hour. Against a stolen database it depends on the hash: a fast one like MD5 or SHA-1 can be tried at enormous rates on consumer graphics hardware, while a purpose-built password hash such as bcrypt or Argon2 is slower by many orders of magnitude.

Below is the worst case, a fast unsalted hash at an assumed ten billion guesses per second. It shows how sharply the curve bends, and is not a measurement:

On average an attacker succeeds in half that time. The practical reading: below 50 bits is not worth much against an offline attack, 60 to 70 bits is fine for most things, and 80 bits and up will stay comfortable.

Length beats symbol soup

Take a 12 character password of letters and digits (71 bits). Adding punctuation, widening the set from 62 to 95 characters, gets you to 79 bits. Adding two more letters or digits instead gets you to 83. Each extra character multiplies the search space by the whole alphabet, while widening the alphabet adds only about 0.6 bits per character you already had. Length wins, and keeps winning.

Composition rules ("must contain an uppercase letter, a digit and a symbol") push people into a narrow set of patterns: capital at the front, digit and exclamation mark at the end. Cracking tools try those transformations first. This is one reason NIST's digital identity guidelines moved away from composition rules and forced periodic changes, in favour of length and checks against known-breached password lists.

Reuse is the real risk

Almost nobody has an account compromised by brute force. What happens is credential stuffing: a weak site is breached, the email and password pairs are published, and automated tools try each pair against hundreds of other services. If you used the same password on your email as on the breached forum, its strength is irrelevant. It was handed over, not guessed.

Phishing works the same way: a 30 character password typed into a convincing fake login page is worth exactly as much as password1. So, in order of what matters:

1. A different password on every site.
2. Two factor authentication on anything important, above all your email, since that is the reset route for everything else.
3. Enough length that offline cracking is hopeless.

Passphrases

A passphrase is several words picked at random from a list, for example harvest-cobalt-mural-drift-plinth. At 12.9 bits per word, five words is 65 bits and six is 78.

Two conditions make this work. The words must be chosen randomly, by dice or by software, not picked by you. And the strength comes from the number of words, not from the separator or from capitalising one letter: a song lyric or a quotation has almost no entropy, because it is drawn from a small pool of things people say.

Passphrases earn their keep for the few passwords you type from memory: your device login, your manager's master password, your disk encryption.

Where a manager fits

A password manager turns "invent and remember 200 unique passwords" into "remember one long passphrase". It generates high entropy strings and fills them in on the right domain, which blunts phishing because it will not autofill on a lookalike address.

It concentrates risk, which is a real objection and still the better trade: one vault behind a long passphrase and a second factor beats one password shared across dozens of sites of unknown quality.

A note on hashing

Hashing is the other side of the login. A well-built service stores a salted hash from a deliberately slow algorithm, never the password itself, so a leak does not immediately yield plaintext. General purpose hashes such as SHA-256 are built to be fast, which makes them excellent for file checksums and a poor choice for storing passwords. Hashing your own password to "make it stronger" achieves nothing: the result is only as unguessable as the input.