"Use a mix of uppercase, lowercase, numbers, and symbols" is the advice everyone's heard since 2003. It's also not what actually stops a modern attacker. The thing that matters most is length — and most of the advice built around complexity rules quietly optimizes for the wrong variable.
Here's what actually makes a password hard to crack, and how to generate one that holds up.
Why Length Beats Complexity
Password cracking is a brute-force math problem: how many possible combinations does an attacker have to try before hitting yours? Every character position multiplies the total number of guesses.
- An 8-character password using only lowercase letters has 26^8 ≈ 209 billion combinations.
- An 8-character password using upper/lower/numbers/symbols has ~95^8 ≈ 6.6 quadrillion combinations — bigger, but still crackable in hours by modern GPU rigs.
- A 16-character password using only lowercase letters has 26^16 ≈ 4.3 × 10^22 combinations — vastly larger than the "complex" 8-character one, despite having a smaller character set.
Adding length multiplies the search space exponentially. Adding character-set complexity only multiplies it linearly. Two extra characters of length beats an entire extra character class almost every time.
This is why correct-horse-battery-staple (28 characters, real words) is dramatically harder to crack than P@ssw0rd1 (9 characters, "complex"), even though the second one looks scarier to a human eye.
What Actually Cracks Passwords in 2026
Two very different attack methods, and length defends against both differently:
Brute force — trying every possible combination. Modern GPU clusters can attempt tens of billions of guesses per second against a leaked, unsalted hash. Length is the direct defense: every extra character multiplies the attacker's required time exponentially.
Dictionary and pattern attacks — instead of trying random combinations, attackers try real words, known leaked passwords, and common substitutions first (@ for a, 0 for o, 1 for i). This is why P@ssw0rd1 is weak despite looking "complex" — it's a dictionary word with predictable substitutions, and cracking tools check those substitutions automatically. This is also why a password should be random, not just long — aaaaaaaaaaaaaaaa is 16 characters but trivially guessed.
The combination that actually holds up: long AND random, not "complex-looking."
The Password Manager Reality
Here's the part the length-vs-complexity debate usually skips: you don't have to remember a random string if you use a password manager. Once that's true, the optimal strategy changes completely — instead of a memorable phrase, generate the longest random string the site will accept (16+ characters, all character classes) and let the manager store it. You only need to memorize one strong password: the one protecting the manager itself, where a passphrase-style approach (long, memorable, random word order) makes sense because you're typing it from memory.
What Makes a Password Actually Weak
- Reused across sites. The single biggest real-world risk isn't crack time — it's credential stuffing, where a password leaked from one breached site gets tried against every other account you own. Length doesn't help if the exact password is already in a leaked database.
- Based on personal information. Birthdays, pet names, and addresses shrink the effective search space enormously — attackers try these first, not last.
- Predictable substitutions.
P@ssw0rd,Summer2026!— these follow patterns dictionary attacks specifically check for. - Short, even with symbols. An 8-character password is weak in 2026 regardless of character mix. Aim for 16+ where the site allows it.
Generating One
Password Generator creates a random password with your choice of length and character sets — the two levers that actually matter, set correctly instead of guessed at.
- Set length to 16 characters minimum — 20+ if the site allows it.
- Include all four character classes (upper, lower, numbers, symbols) for the linear boost, but don't rely on them to compensate for short length.
- Generate a unique password per site. Never reuse one, even a strong one — a breach on one site shouldn't unlock the rest of your accounts.
- Store it in a password manager rather than trying to memorize it.
Quick FAQ
Is a passphrase like "correct horse battery staple" actually secure? Yes, if it's genuinely randomly chosen from a large word list (this is the basis of Diceware) rather than something you made up — human-invented phrases follow guessable grammatical patterns that crackers account for.
Do I need to change passwords every 90 days?
No — this old advice is now widely considered counterproductive; it pushes people toward predictable incrementing patterns (Password1, Password2). Change a password when it's involved in a breach, not on a timer.
Does 2FA make password strength less important? It significantly reduces the damage from a cracked or leaked password, but it doesn't make weak passwords fine — not every account offers 2FA, and a strong unique password is still the first line of defense.
What's the actual minimum length in 2026? 12 characters is the widely cited floor; 16+ is the comfortable safety margin against current cracking hardware, and the gap keeps growing as GPUs get faster.
Related Free Tools
- Password Generator — generate a long, random password with custom length and character sets
- Hash Generator — see how passwords get hashed for storage (and why speed matters there too)
- UUID Generator — generate unique random identifiers, a related but distinct use case
- JWT Decoder — inspect the tokens issued after you log in with that password