How to make a strong password (and why most advice is wrong)

What a password attack actually looks like

Nobody sits and guesses. When a site is breached, attackers get a file of scrambled passwords and run it against hardware that tries billions of candidates per second. Your password is safe only if the number of things they have to try is impractically large.

Crucially, they do not start at aaaa and work up. They start with wordlists built from every password ever leaked, then common substitutions, then common patterns - a capital at the start and a digit and exclamation mark at the end, because that is what password rules push everyone toward.

So there are two separate questions. Is your password in a list someone already has? And if not, how many combinations would it take to reach it?

Why length beats everything else

Adding a character multiplies the search space by the size of the alphabet. Adding a character type only widens the alphabet itself, which has a far smaller effect than people assume.

Work it through. A lowercase alphabet is 26 characters, so an eight-character lowercase password gives about 200 billion combinations. Add symbols and digits and you widen the alphabet to about 95, giving roughly 6,600 trillion for the same eight characters - a real improvement. But simply making it twelve lowercase characters instead gives about 95,000 trillion, which beats it comfortably, and it is a great deal easier to type on a phone.

Password Fort makes this visible. Build a password character by character and watch the estimated crack time move: two more letters sends it jumping, one more symbol barely nudges it.

• Every extra character multiplies the combinations
• Every extra character type only widens the alphabet
• Twelve simple characters beat eight complicated ones
• Length is also the part you can remember

The advice that does not work

Swapping letters for lookalike digits does almost nothing. Turning password into p4ssw0rd feels clever, but crackers have applied those substitutions automatically for twenty years - it is one of the first things a wordlist attack tries.

Forced complexity rules backfire for the same reason. If a site demands a capital, a digit and a symbol, almost everyone produces the same shape: capital at the front, digit and exclamation mark at the end. The rule narrows the search rather than widening it.

Forced rotation every ninety days backfires too. People respond by incrementing a number, so Summer2025! becomes Summer2026!, which any attacker with the old one will try first. Both the UK's NCSC and America's NIST now advise against routine expiry for exactly this reason.

What to do instead

Use a passphrase of four or more unrelated words. Something like copper-lantern-dust-marble is long, memorable and not in any wordlist, because wordlists contain phrases people actually use rather than random combinations.

Never reuse a password across sites. Reuse is what turns one company's breach into your problem everywhere, and credential stuffing - trying a leaked pair on hundreds of other sites - is completely automated.

Use a password manager for everything you do not need to type from memory, and keep two or three strong memorised passphrases for the accounts that unlock the rest. Then turn on two-factor authentication where it is offered: it means a stolen password on its own is not enough.

• Four or more unrelated words, not a quotation or a song lyric
• A different password for every site
• A password manager for the long tail
• Two-factor authentication on email and banking first

Teaching this to children

Rules without reasons do not survive. A child who has watched an estimated crack time collapse from centuries to instantly the moment they typed a common word understands the wordlist problem permanently, and one who has broken a cipher by trying every key understands what a key is for.

Password Fort and Cipher Lock are built for exactly that: they show the attacker's side, which is the part that makes the advice make sense.