What Makes a Password Strong? (Length, Uniqueness, and Randomness)

Most password advice sounds like a recipe: eight characters, one capital letter, one number, one symbol, done. That recipe is out of date. A password is not strong because it looks complicated to a human eye. It is strong because an attacker, trying guesses in the smartest possible order, would still need an impractical number of attempts — and because, if one account leaks, it does not hand over all your other accounts too.

That comes down to three properties: length, randomness, and uniqueness. Miss any one of them and the other two cannot fully save you.

The short answer: long, random, unique

The US Cybersecurity and Infrastructure Security Agency (CISA) sums up its guidance in the same three words: make passwords long (at least 16 characters), random, and unique, store them in a password manager, and turn on multi-factor authentication (MFA) for your important accounts. See CISA’s guide at cisa.gov/secure-our-world/use-strong-passwords. The rest of this article explains why each part earns its place — and where the usual advice goes wrong.

Length: the factor that does the most work

Every character you add multiplies the number of possible passwords. That is why length beats cleverness: adding characters grows the search space far faster than swapping a letter for a symbol ever could.

For a password chosen at random, strength can be measured in bits of entropy, where each bit doubles the number of guesses an attacker must make. The arithmetic is length multiplied by the logarithm (base 2) of the number of possible characters at each position. Using the full set of 94 printable characters (upper- and lowercase letters, digits and symbols, 6.55 bits each):

• A random 8-character password: 8 × 6.55 ≈ 52.4 bits.
• A random 16-character password: 16 × 6.55 ≈ 104.9 bits.

Doubling the length roughly doubles the bits — which means the 16-character password is about 2^52 times harder to guess, not twice as hard. By contrast, widening the character set from letters and digits (62 characters, 5.95 bits each) to the full printable set adds only about 10% per character. Symbols help a little; length helps enormously.

So how long should a password be? Current NIST digital-identity guidance (SP 800-63B) sets a minimum of 15 characters when a password is the only authenticator, and 8 when it is one factor among several in MFA, and expects services to allow passwords of at least 64 characters so long passphrases are never cut off. CISA’s everyday advice is simpler: at least 16 characters, and longer is stronger. Treat 16 as a practical floor for accounts that matter. If a password manager fills the password in for you, there is no reason to stop at 16.

One condition sits behind all of this arithmetic: it only applies when the characters are chosen at random. A 20-character password made of a familiar phrase is not 20 characters of randomness.

Randomness: why human-chosen “clever” passwords fail

Attackers do not guess passwords one at a time by hand. They run software that tries enormous lists of likely candidates first: common passwords, dictionary words, names, dates, keyboard patterns, and passwords leaked from earlier breaches. A password is weak when it appears on one of those lists or follows a pattern the software already knows.

That is why the old tricks fail. Swapping letters for lookalike symbols is the first thing cracking tools try, because millions of people have made exactly the same swap. A dictionary word with a number or symbol bolted on the end is guessed once the word is guessed. Keyboard walks, dates, pet names and favourite teams are all guessable from wordlists or from information that is often public. And a small change to an old password, like adding a digit, is a short step from a version an attacker may already know.

Real randomness means the choice did not pass through your preferences at all. The reliable ways to get it are a password manager’s generator or a passphrase built from words picked at random — for example, by rolling dice against a wordlist — rather than words you chose because they mean something to you. Humans are bad at being random; generators are not. Let the generator do the choosing, and use your memory only for the few passwords you genuinely must type yourself.

Uniqueness: the rule that limits the damage from a breach

Uniqueness is the property most people underestimate, and it matters most when something goes wrong. When a website is breached, attackers take the leaked email-and-password pairs and try them automatically against other popular services. This is called credential stuffing, and it works precisely because so many people reuse passwords.

Length and randomness decide how hard a password is to guess. Uniqueness decides how far a single leak can spread. A long, random password reused on ten sites is still one leak away from ten compromised accounts. A unique password per site turns a breach at one service into a contained problem: change that one password and you are done.

That is also why a strength score on its own can mislead you. A checker can tell you a password looks long and varied. It cannot tell you whether you have already used the same password somewhere else, or whether it has appeared in a breach. Uniqueness is something only you — or your password manager, which can flag reused passwords — can guarantee.

Passphrase or random string? Pick by how you will use it

Both approaches work, if the words or characters are genuinely random. The choice depends on whether a human needs to remember and type the password.

Use a random string when a password manager fills it in. If you never type the password, memorability does not matter, so a long string of random characters is the strongest simple option. Aim for 16 characters or more.

Use a passphrase when you must remember it. A passphrase is several unrelated words joined together. Each word picked at random from a 7,776-word list contributes about 12.9 bits, so four random words carry about 51.7 bits and five about 64.6 bits — roughly comparable to a random 8-character and 12-character password respectively, but far easier to type and remember. The key word is random. A passphrase made of a song lyric, a famous quotation or a sentence you invented is not random, however long it is, because attackers’ lists include exactly those phrases.

A note that applies to both: never adopt a passphrase or password you read in an article, a guide or a tool’s sample output. Published examples are, by definition, already known to everyone, including attackers.

What a strength checker can — and cannot — tell you

A strength checker is a useful second opinion, but only within its limits. Manage My Tools’ Password Strength Checker estimates how resistant a password looks based on its length and the variety of characters it uses, and it runs entirely in your browser — what you type is not sent anywhere or stored. That makes it a safe place to test a candidate password before you commit to it.

What it cannot do is just as important, and its own page says so plainly: it cannot know whether a password has appeared in a data leak, whether you have reused it, or whether it is built from personal details someone else could guess. Its estimate is never a guarantee about any account.

So use the checker for what it is good at — spotting a password that is too short or too narrow in character variety — and treat a good score as a starting point, not a verdict. If the checker says a password looks strong but you have used it before, or it contains your pet’s name, it is not strong in practice.

Five mistakes that weaken an otherwise long password

1. Reusing it anywhere. One leak becomes many compromised accounts. This is the single most damaging habit, and it defeats even a long, random password.
2. Building it from personal details. Birthdays, pet names, team names and anniversaries are often public or guessable, and they shrink the search space to a tiny list.
3. Trusting symbol swaps. Replacing a letter with a lookalike symbol is predictable, not clever, and cracking tools try those substitutions first.
4. Making tiny variations of one base password. If one version leaks, the next version is easy to predict. A different password per account means genuinely different, not one digit apart.
5. Copying a published example. Any password printed in a guide, a forum post or a tool’s sample output is already in attackers’ lists. Examples are for understanding, never for use.

A practical routine that actually holds up

You do not need to memorise dozens of long passwords — and you should not try. This routine is the one CISA and NIST guidance both point to:

1. Use a password manager. It generates long, random, unique passwords and fills them in for you, so you only need to remember one strong passphrase: the one for the manager itself. Make that passphrase your longest and best-guarded.
2. Turn on MFA where it is offered, starting with email, banking, social media and financial accounts. A second factor protects you even if a password leaks or is phished.
3. Give your most important accounts the longest passwords. Email first: whoever controls your email can usually reset your other passwords.
4. Change a password when you have a reason to — a breach notification, a reused password you have just discovered, or typing it into a suspicious site. Modern guidance does not call for scheduled changes every few months; forced rotation tends to produce small, guessable tweaks instead of genuinely new passwords.
5. Check a new password before you commit. Run a candidate through the Password Strength Checker to catch obvious weaknesses in length or variety, then check yourself on the two things it cannot see: have you used it before, and does it contain anything personal?

FAQ

How long should a password be? At least 16 characters is a sound practical floor for accounts that matter, following CISA’s guidance; NIST guidance sets 15 characters as the minimum when a password stands alone and expects services to allow at least 64. Longer is stronger, and if a password manager fills it in, there is no cost to going longer still.

Is a passphrase as strong as a random string of characters? It can be, if the words are chosen at random. Five random words carry roughly as much entropy as a random 12-character password, and are much easier to remember. A passphrase made of a familiar phrase or lyric is not random, and is far weaker than its length suggests.

If a checker says my password is strong, is my account safe? Not necessarily. A checker estimates strength from length and character variety only. It cannot see whether the password has leaked, whether you reused it, or whether it contains personal details. A good score plus uniqueness is what makes a password strong in practice.

Should I change my passwords regularly? No — not on a schedule. Change a password when there is evidence of compromise, when you discover you reused it, or after entering it somewhere suspicious. Regular forced changes usually produce small tweaks to the old password, which attackers can predict.

What should I do if a password I reused has leaked? Change it everywhere you used it, starting with email and financial accounts, and replace each one with a unique password stored in your password manager. Then turn on MFA for the accounts that offer it, so a leaked password alone is not enough next time.

Check your password idea before you commit

Length, randomness and uniqueness are not three separate tips — they are three checks on the same password. A long password that is predictable is weak. A random password reused everywhere is a single leak away from disaster. A unique password that is short is easy to guess.

Before your next new account, test the candidate you have in mind with the Password Strength Checker — it runs in your browser and sends nothing anywhere — then run the two checks no tool can do for you: is it genuinely different from every password you already use, and does it contain anything about you that someone else could guess? If it passes all three, it is a strong password. You can browse the rest of the Password Tools category or all free tools if the job needs a different tool.