2.1: What Makes a Password Strong

What Makes a Password Strong

Set aside the “at least one uppercase letter and one symbol” rules for a moment. A password’s real strength comes down to a single number: how many guesses would a machine need to find it? Security people call this entropy, and it’s just a count of possibilities. If your password is one of a million things you might plausibly have chosen, a rig making a billion guesses per second doesn’t even notice the work. If it’s one of a trillion trillion things, the same rig needs longer than the universe has existed.

Two things grow that space of possibilities: the variety of characters, and, far more powerfully, the length.

Length beats complexity

The industry has a favorite embarrassing example. Tr0ub4dor&3 is eleven characters of capitals, numbers, and symbols, the kind of password every signup form demands, and it feels strong. But cracking software knows all the human tricks. It tries dictionary words with o→0 and a→4 swaps and a symbol-digit tail first, because that’s what people do. The pattern is predictable, so the real guessing space is small.

Now take four random common words: mango-turbine-frost-caravan. No symbols, nothing clever. Four words chosen randomly from even a modest few-thousand-word list gives you thousands × thousands × thousands × thousands of possibilities — a space so much larger than the mangled-word pattern that the comparison stops being close. It’s also the password you can remember and type on a phone.

So the rule: a longer password made of random words beats a shorter one made of symbol soup, every time. Complexity rules trained us to write passwords that are hard for humans to remember and easy for machines to guess.

Try it yourself

The lab below runs entirely in your browser. Type patterns — shapes of passwords like the ones you use, never your real passwords — and watch the estimated crack time for an offline rig change as you add length versus symbols. (The second panel is for Lesson 2.5; you’ll come back to it.)

Give it two minutes: cat, then caterpillar, then three words, then four. Watch what length does that symbols don’t.

One more catch, and it connects to Lesson 1.2

A strong password that has leaked is a weak password. Cracking rigs and stuffing software don’t start guessing from aaaa. They start from lists of real, already-leaked passwords, because humans repeat themselves. If your beautiful 20-character passphrase ever appeared in a breach dump, it’s in the dictionary now, and it gets guessed on the first pass no matter what the entropy math says.

So strength has two requirements, not one: hard to guess, and never leaked. You now understand the first. The second you can’t know by looking, because a password doesn’t feel any different after it leaks. You have to check it against the record, and in Lesson 2.5 you will.

That leaves one problem: you need a different strong password for every account, and no human memorizes fifty random passphrases. The tool that solves this is next.