What Actually Makes a Password Strong in 2026 (Entropy, Not Just Length)

By Daniel Okafor · September 12, 2026 · Security

A long password is not necessarily a strong one. The real measure is entropy, the bits of uncertainty an attacker must search through, and it changes how you should generate and compare credentials.

Ask almost anyone what makes a password strong and you will get the same answer: make it long, add a number, add a symbol. That advice is not wrong, exactly, but it describes the surface of the problem rather than the thing that actually matters. The property an attacker is fighting against is entropy, the amount of uncertainty in the password measured in bits. Two passwords of identical length can be orders of magnitude apart in entropy, and the difference decides how long a cracking attempt takes far more reliably than any character count.

Understanding entropy changes the way you think about credentials. It explains why a twenty character password built from a pet name and a birthday can be weaker than a twelve character random string, why passphrases punch above their length, and why the rules enforced by many websites are a poor proxy for the property they are trying to protect.

In this article:

What entropy actually measures

Entropy is the number of equally likely possibilities an attacker must consider, expressed in bits. One bit of entropy means two possibilities, ten bits means roughly a thousand, twenty bits means roughly a million, and each additional bit doubles the search space. A password with forty bits of entropy requires an attacker to try, on average, around half a trillion candidates to be certain of finding it. Sixty bits raises that to a quintillion.

The crucial point is that entropy is a property of how the password was chosen, not of the string itself. A password that looks random but was produced by a predictable process has low entropy regardless of its appearance. This is why you cannot measure the strength of a single password by inspecting it; you can only measure the strength of the method that generated it.

How length and character sets combine into bits

For a password chosen uniformly at random from a known set of characters, the entropy is the base two logarithm of the number of possible passwords. That works out to the length multiplied by the bits per character, where bits per character is the logarithm of the alphabet size. A lowercase alphabet of twenty six letters gives about 4.7 bits per character. Adding uppercase, digits and a reasonable set of symbols brings the alphabet to roughly ninety five characters, which gives about 6.6 bits per character.

This is where the familiar advice comes from, but notice what it implies. Going from lowercase only to a full mixed alphabet adds less than two bits per character. Adding four characters of length at the smaller alphabet adds nearly nineteen bits. Length is the dominant lever, and complexity is a secondary adjustment, which is the opposite of how most password rules prioritise.

Three worked examples comparing real passwords

Example one: the personalised long password

Consider "SunshineSummer2019!", a nineteen character password containing uppercase, lowercase, digits and a symbol. By the surface rules it looks strong. But it was not chosen randomly: it is two common words, a year, and a punctuation mark. A dictionary attack with common word lists and year appending rules covers this combination in a tiny fraction of the space that the character count suggests. Its effective entropy is perhaps twenty to twenty five bits, not the hundred plus that a random nineteen character string would carry. Against an offline cracking run it falls in seconds.

Example two: the short random string

Now take a twelve character string generated uniformly from the full ninety five character alphabet, such as "7Kq$mP2v!xR+". Its entropy is twelve times 6.6, roughly seventy nine bits. That is around forty sextillion possibilities, which is well beyond practical brute force on consumer hardware for the foreseeable future. It is shorter than the first example and far stronger, because every character was chosen independently and uniformly.

Example three: the four word passphrase

A passphrase of four words drawn uniformly from a list of seven thousand seven hundred and seventy six words, the size of a well known word list, carries about twelve point nine bits per word, so roughly fifty two bits total. A five word version reaches about sixty five bits, comparable to a ten character fully random string but dramatically easier for a human to type and remember. This is why passphrases are the recommended form for a master credential you must recall unaided.

Why human patterns destroy entropy

The gap between the examples above is entirely about the selection process. People do not choose characters uniformly. They capitalise the first letter, place digits at the end, use a single symbol, substitute three for E and one for I, and build from words that mean something to them. Every one of these habits is modelled by modern cracking tools, which apply transformation rules to dictionary entries rather than brute forcing character by character.

The practical consequence is that a password you invented is almost always far weaker than its length implies. The entropy you can honestly claim for a human chosen password is low, often below thirty bits, no matter how long or symbol laden it looks. Only generation by a uniform random process delivers the entropy the length suggests.

Common mistakes when judging password strength

FAQ: edge cases in password strength

Does a longer password always beat a shorter one?

Only when both are chosen randomly. A thirty character sentence from a famous quote has low entropy because the quote is in every dictionary. A sixteen character random string is stronger. Compare by entropy, not by character count.

Are passphrases always better than random strings?

For a credential you must remember unaided, yes, because they deliver high entropy at a tolerable memorisation cost. For a credential stored in a manager and never typed, a random string is preferable because it is shorter for the same entropy and immune to any word list attack.

How many bits are enough?

For ordinary accounts, around sixty bits is a comfortable target against offline attacks on consumer hardware. For your email or password manager master credential, aim for eighty bits or more, since that account is the recovery route for everything else.

Does adding a symbol to the middle help more than at the end?

Against a naive brute forcer, marginally. Against a rule based attack that already tries symbols in every position, not meaningfully. Position does not matter for a uniformly random password because every position is already unpredictable.

Wrapping up

Strength is entropy, and entropy is a property of how you generate a password, not how it looks. Choose uniformly at random, prefer length over complexity, use a passphrase when you must remember it, and let a generator produce everything else. That is the entire reliable method, and it is more dependable than any rule about capitals and symbols.

Generate a high entropy password in seconds and let your manager remember it.

Try the Password Generator tool.

SwiftMultiTool — free online tools for everyone. Home · Blog · About · FAQ · Contact