How Strong Is Your Password? Entropy, Explained Without the Maths Degree

Password advice has been wrong for twenty years. The rules most sites still enforce — one capital, one number, one symbol, change it every 90 days — were formalised in 2003 by a US government researcher who later said publicly that he regretted them.

Here is what actually makes a password hard to break, and why the old rules produce passwords that are simultaneously hard to remember and easy to crack.

Length beats complexity, by an enormous margin

Password strength is measured in entropy — the number of guesses required. Every character multiplies the possibilities; complexity only widens the alphabet.

The four-word phrase has no capitals, no digits and no symbols, and it is vastly stronger — because it is 28 characters long. It is also the only one of the three you could recall tomorrow.

Why the old rules backfire

Told to add a capital, a digit and a symbol, almost everyone does the same three things: capitalise the first letter, put the digit at the end, and make the symbol an exclamation mark. Password1! satisfies every complexity rule ever written and appears in the first few thousand entries of any cracking dictionary.

Attackers do not brute-force character by character. They run dictionaries of real leaked passwords and apply the substitutions humans reliably make — a→@, e→3, o→0, i→1. P@ssw0rd is not a disguised word; it is a word with the disguise everyone uses.

What to use instead

Passphrases, for anything you must remember

Four or five unrelated words. Unrelated is the important part — "correct horse battery staple" works because those words have no reason to appear together; "let me in please" does not, because it is a phrase that exists.

Add a number or symbol somewhere in the middle if a site insists. Do not put it at the end, where every cracking rule looks first.

Generated random strings, for everything else

For the ninety accounts you will never type by hand, use 16+ random characters from a generator and let a password manager remember them. Our password generator produces both random strings and passphrases, using your browser's cryptographic random number source rather than a predictable one.

It runs entirely on your device, and nothing you generate is transmitted. That is not a nicety — a password generator that sends results to a server is worse than useless.

Reuse is the real problem

The strongest password in the world is worthless if you use it in two places. Breaches happen constantly; when a small forum leaks its database, attackers immediately try those email-and-password pairs on Gmail, banks and Instagram. This is called credential stuffing and it is the most common way ordinary accounts are taken over.

The rule that matters more than any complexity requirement: every account gets its own password. That is only practical with a password manager, which is why using one is the single highest-value security change most people can make.

Two-factor authentication matters more than your password

With 2FA switched on, a stolen password alone is not enough. In order of strength:

1. Hardware key (YubiKey and similar) — strongest, phishing-resistant
2. Authenticator app (Google Authenticator, Authy) — strong, works offline
3. SMS codes — weakest, because SIM swapping is real and common in India — but still far better than nothing

Turn it on for email first. Your email account is the master key: anyone holding it can reset the password on everything else you own.

Forced rotation is counterproductive

NIST's current guidance explicitly recommends against routine expiry, and the reason is behavioural: people forced to change passwords quarterly produce Summer2025!, then Autumn2025!. The sequence is predictable and the security is worse than leaving a strong password alone.

Change a password when there is a reason: a breach notification, a shared device, a suspicion. Not on a calendar.

A workable setup

1. Pick a password manager and put everything in it
2. Protect it with one long passphrase — the only password you memorise
3. Turn on 2FA for the manager, then email, then banking
4. Generate a fresh random password for every account, starting with the important ones
5. Check your email address on a breach-notification service and change anything it flags

If you use QR codes to share a Wi-Fi password rather than reading it aloud, the same caution applies — see how Wi-Fi QR codes work, and put the code on a guest network.

That takes an evening and puts you ahead of the overwhelming majority of people. The goal is not a perfect password — it is that one leaked password stops being a problem for every other account you own.