What Actually Makes a Password "Strong"? (It’s Not What Most People Think)

A lot of people assume a password becomes "strong" by swapping letters for symbols — turning "password" into "p@ssw0rd," for instance. In reality, this trick barely helps, because it’s one of the very first patterns automated password-guessing tools already check for. A password’s real strength comes from two very different things: length, and unpredictability.

Length matters enormously because of how password-guessing actually works. A computer trying to guess a password by brute force has to try combinations one by one, and every extra character multiplies the number of possible combinations dramatically. A short password, even with symbols mixed in, can often be guessed by a computer in minutes or hours. A genuinely long password — even one made of ordinary words — can take centuries to guess through brute force alone, simply because there are so many more possible combinations to check.

Unpredictability matters just as much, but in a different way: a password shouldn’t be something guessable from knowing the person, like a birthday, a pet’s name, or a favorite sports team — these are exactly the details attackers try first, especially with information many people share on social media, sometimes without realizing it helps someone guess their passwords.

A common recommendation that captures both ideas at once: a "passphrase" — several random, unrelated words strung together (like "correct-horse-battery-staple") — is both long and unpredictable, and is often far easier to remember than a short jumble of symbols, while being much harder for any guessing tool to crack.