What actually makes a password strong (it is not what you were taught)

For twenty years people were told the same things: use a capital, a number and a symbol, change it every ninety days, and never write it down. Most of that advice has since been withdrawn by the organisations that issued it, because measurement showed it produced worse passwords rather than better ones.

The reasoning is worth understanding, because it changes what you should actually do.

Length matters far more than complexity

Guessing attacks work through possibilities. Each additional character multiplies the number of possibilities by the size of the alphabet in use, and that multiplication compounds far faster than adding symbol types to a short password does.

A password of eight characters using every symbol on the keyboard has fewer possibilities than a password of sixteen characters using only lowercase letters. Not slightly fewer — dramatically fewer. Length is exponential in a way that character variety simply is not.

This is why the modern advice starts with length. Sixteen characters of almost anything beats eight characters of carefully chosen chaos, and it is easier to type on a phone.

Why the old rules backfired

When a system demands a capital, a number and a symbol, people comply in extremely predictable ways. The capital goes at the start. The number goes at the end. The symbol is an exclamation mark, also at the end. The number is frequently a year, and often the current one.

Substitutions follow the same pattern. Replacing an e with a 3 and an a with an @ feels clever, but every cracking tool has known those substitutions for decades and applies them automatically. Password becomes P@ssw0rd! and the additional effort required to guess it is close to zero.

• Predictable capitalisation: almost always the first letter
• Predictable numbers: a year, a birth date, or 123 at the end
• Predictable symbols: an exclamation mark, at the end
• Character substitutions: known to every cracking tool ever written
• Forced ninety-day rotation: produces Summer2026, then Autumn2026

Mandatory rotation deserves its own mention, because it is the rule that did the most harm. Asked to change a password every quarter, people make the smallest possible change, which makes the next one predictable from the last. Guidance from major standards bodies now recommends against routine expiry, and says to change a password when there is a reason to believe it has been exposed.

What to do instead

There are two good approaches, and which you choose depends on whether you need to remember it.

For passwords you must type from memory — the one that unlocks your password manager, your device login — use a passphrase. Four or five unrelated words strung together produce something long, memorable and genuinely hard to guess, provided the words are chosen at random rather than by you. Human-chosen words are far less random than we believe.

For everything else, do not remember them at all. A password manager generates a long random string for each account and types it for you. You then have exactly one password to remember, and every account gets a unique one, which solves the more dangerous problem described below.

Reuse is the real danger

Strength matters less than uniqueness, and this is the part most people underestimate. When a website is breached, the attacker gains a list of email addresses and passwords. The very first thing that list gets used for is trying those same pairs on other sites.

So a magnificently strong password used on five sites is weaker in practice than five mediocre passwords used once each. The breach of the least careful site you ever signed up to becomes a key to your email, and your email is the reset mechanism for everything else.

The password that matters most is the one on your email account, because whoever controls that can reset all the others.

Where a strong password is not enough

Two-factor authentication matters more than password strength for any account you would be upset to lose. It means a stolen password alone is not sufficient, which defeats the credential-stuffing attack above entirely.

An app-based code or a hardware key is meaningfully better than a code sent by text message, since text messages can be redirected by someone who persuades a mobile operator to move your number. But a text-message code is still far better than nothing, and turning something on today beats planning a better system indefinitely.

One last practical note: writing a password down is not the sin it was made out to be. A note kept in your wallet is protected against the internet, which is where the attacks actually come from. It is the sticky note on the monitor in an open-plan office that was the problem, not the writing.