The arithmetic behind strength meters, and why most complexity rules make passwords worse.
Password advice has been bad for so long that a lot of people follow rules which actively reduce security. "At least one uppercase, one number and one special character" produces Password1! with dreary reliability. Meanwhile the thing that genuinely matters — length, and never reusing a password — gets mentioned last if at all.
This guide works through the actual arithmetic. None of it is complicated, and once the numbers are in front of you the practical rules follow naturally.
The first correction: nobody starts at aaaaaaaa and counts upward. That would be enormously wasteful when human password choices are so predictable.
A real attack works in order of likelihood. It starts with the few hundred million passwords already exposed in previous breaches. Then dictionary words, names, sports teams and dates. Then those with predictable decorations bolted on — capital first letter, digits appended, ! at the end, vowels swapped for lookalike numbers. Cracking software has known about @ for a and 3 for e since the 1990s; these substitutions are rules in the tool, not obstacles to it.
So the real question is never "how many combinations exist?" It is "how far down the guessing order does my password sit?" A password only benefits from the size of the search space if it is genuinely random within it.
For a genuinely random password, strength is measured in bits of entropy:
bits = length x log2(size of character set)Each character set contributes a fixed amount per character:
| Character set | Size | Bits per character |
|---|---|---|
| Digits only | 10 | 3.32 |
| Lowercase letters | 26 | 4.70 |
| Upper + lower | 52 | 5.70 |
| Upper + lower + digits | 62 | 5.95 |
| All printable ASCII | 95 | 6.55 |
The revealing part is how little the character set matters compared with length. Going from lowercase-only to full ASCII buys 1.85 bits per character. Adding a single extra lowercase character buys 4.70 bits. One more character is worth more than every symbol on the keyboard.
Compare two passwords:
Tr0ub4dor&3 — 11 characters, looks fierce, but it is one dictionary word with textbook substitutions. Cracking software models it as roughly 28 bits.correcthorsebatterystaple — 25 characters, all lowercase, no symbols. Four words chosen at random from a large list gives about 44 bits.The second is thousands of times stronger and vastly easier to type and remember. That is the entire argument for passphrases.
Bits only mean something alongside guess rate, which depends on how the password is stored. Two scenarios matter.
Guessing against a live login form is slow — network latency, rate limiting, lockouts. Even an unusually permissive service might allow a few hundred guesses per second. At that rate, anything above about 40 bits is untouchable, and the practical risk is not brute force at all but your password already appearing in a breach list.
If a site is breached and its password database stolen, the attacker guesses locally against the stolen hashes at whatever speed their hardware allows. Here the site's choices dominate:
| How the site stored it | Guesses per second (single GPU, order of magnitude) |
|---|---|
| Unsalted MD5 or SHA-1 | tens of billions |
| Salted SHA-256 | billions |
| bcrypt (cost 12) | a few thousand |
| Argon2id (tuned) | hundreds |
The spread is roughly ten million to one. A password that falls in seconds against MD5 can hold for centuries against Argon2id. You have no control over which a given site uses — which is precisely why the defence that is in your control matters so much.
Almost nobody is individually targeted by password cracking. What actually happens is credential stuffing: an attacker takes username-and-password pairs from a breach of some forum nobody remembers signing up to, and replays them automatically against banks, email providers and shopping sites.
No cracking is involved. The password was already known. It works because the same pair was used elsewhere.
This reframes everything. A magnificent 80-bit password used on twenty sites is weaker in practice than twenty mediocre ones used once each, because the strong password's security is capped by the worst-run site you ever gave it to. Uniqueness beats strength. Ideally you have both, but if you can only fix one thing, fix reuse.
Email deserves special mention. Password resets for everything else arrive there, so a compromised mailbox unlocks accounts whose passwords were never exposed at all. It should have your strongest unique password and a second factor.
A passphrase is several words picked at random from a known list. The randomness is what counts — a phrase you invented is a phrase a language model can predict.
With a 7,776-word list, each word contributes log2(7776) = 12.9 bits:
| Words | Entropy | Assessment |
|---|---|---|
| 3 | 38.8 bits | Too weak for anything offline |
| 4 | 51.7 bits | Fine for low-stakes accounts |
| 5 | 64.6 bits | Solid general-purpose choice |
| 6 | 77.5 bits | Strong; suitable for a master password |
| 7 | 90.5 bits | Beyond any foreseeable attack |
Crucially, this arithmetic assumes the attacker knows exactly which word list you used and that you used four words. That is the correct assumption — security should never depend on your method being secret — and the numbers hold up anyway.
qwerty, 1qaz2wsx, zxcvbnm are all in the first few thousand guesses.1! is a standard mangling rule. It adds essentially nothing.MyPasswordFacebook and MyPasswordGmail are one pattern. If one leaks, both fall.Spring2026! then Summer2026!. Current NIST guidance explicitly recommends against scheduled expiry, advising changes only on evidence of compromise.A good meter does not count character classes. It estimates how many guesses a realistic attacker would need, by looking for dictionary words, names, dates, keyboard patterns, repeats and common substitutions, then scoring the cheapest way to construct your password from those pieces.
That is far more honest than a class-counting meter, which rates P@ssw0rd! highly for having four character types while missing that it is among the most-guessed passwords in existence. But no meter is authoritative — none can know that your "random" phrase is a song lyric, or that you used it on another site last year.
One caveat worth stating plainly: any password generator you use should draw from a cryptographically secure random source, not from an ordinary pseudo-random function. The difference is invisible in the output and total in the consequences — a predictable generator produces passwords that look random and are not.