Passwords remain the dominant authentication mechanism on the internet despite decades of work toward passwordless alternatives. The average user now manages hundreds of accounts, each ideally secured with a unique credential. Yet password breaches continue at an industrial scale — billions of credentials are exposed annually through database dumps, phishing campaigns, and credential stuffing attacks. Understanding the science behind password strength — and the updated guidance from standards bodies — is essential for anyone responsible for user authentication, whether you are designing a login system or simply trying to protect your own accounts.
Password strength is most accurately measured as entropy — the number of bits required to represent the total number of possible passwords given a particular construction method. A password with N bits of entropy means an attacker must try at most 2^N passwords to guarantee finding it by brute force, and on average will find it after 2^(N-1) attempts.
Entropy calculation: if a password is drawn uniformly at random from an alphabet of size A and has length L, its entropy is L × log2(A) bits.
- 8-character lowercase-only: 8 × log2(26) ≈ 37.6 bits. Trivially brute-forceable with modern hardware.
- 8-character with uppercase, lowercase, digits, symbols (95 printable ASCII characters): 8 × log2(95) ≈ 52.4 bits. Crackable offline with GPUs in days to weeks.
- 12-character full character set: 12 × log2(95) ≈ 78.6 bits. Significantly harder — years to centuries offline.
- 16-character full character set: 16 × log2(95) ≈ 104.9 bits. Effectively uncrackable with foreseeable hardware.
These calculations assume the password is truly random. Human-chosen passwords are not random — they follow predictable patterns (capital first letter, number or symbol at the end, common word substitutions). This dramatically reduces effective entropy below the theoretical maximum.
NIST's Special Publication 800-63B, Digital Identity Guidelines, was substantially revised in recent years and again updated in 2024. The guidance represents a significant departure from older conventional wisdom:
Length Over Complexity
NIST now recommends focusing on password length as the primary security driver rather than character class complexity requirements. A long, memorable passphrase is more secure than a short, complex password — and is far more likely to be used correctly (without being written down). Minimum password lengths of 8 characters are the bare floor; 15 characters or more is recommended for sensitive accounts.
No Mandatory Periodic Rotation
NIST explicitly recommends against forcing users to change passwords on a regular schedule (e.g., every 90 days) unless there is evidence of compromise. The research shows that forced rotation leads to predictable password patterns (Password1! → Password2! → Password3!) and user behavior that reduces overall security. Passwords should be changed only when there is reason to believe they have been compromised.
No Complexity Rules
Requirements like "must include uppercase, lowercase, number, and symbol" are also disfavored in the 2024 guidance. They do not reliably increase entropy and they produce user frustration that drives workarounds. If complexity rules are used, they should be minimal and not overly prescriptive.
Breached Password Checks
NIST SP 800-63B-4 explicitly requires that organizations check new passwords against known-breached password lists during account creation and password changes. Services like HaveIBeenPwned's Pwned Passwords API (which can be queried using k-anonymity to avoid sending the full password hash) enable this check without exposing user passwords to third parties.
Understanding how attackers crack passwords helps you appreciate why certain defenses are essential:
Dictionary Attacks
Attackers start with wordlists containing millions of common passwords, phrases, and previously leaked credentials. Tools like Hashcat and John the Ripper can test billions of candidates per second against unsalted MD5 hashes using consumer GPU hardware. The RockYou wordlist (14 million passwords from a 2009 breach) is still a standard starting point.
Rule-Based Attacks
Dictionary attacks are extended with transformation rules: capitalize the first letter, append digits, replace letters with look-alike symbols (a→@, e→3, i→1). These rules model the exact patterns humans use when told to add complexity to a password. "Password" becomes "P@ssw0rd" in one rule application — and this entire space is tested in seconds.
Brute Force
Systematically trying every possible combination of characters up to a given length. Effective for short passwords but exponentially expensive as length increases. Modern GPUs can test approximately 100 billion MD5 hashes per second — an 8-character password using the full 95-character ASCII set has about 6.6 quadrillion combinations, which at this rate takes roughly 19 hours.
Rainbow Tables
Precomputed lookup tables mapping hash values to passwords. Defeated by salting — adding a unique random value to each password before hashing ensures that the same password hashed for different users produces different hash values, rendering rainbow tables useless. All modern password hashing functions (bcrypt, Argon2) include salting automatically.
Credential Stuffing
Using leaked username/password pairs from one breach to attempt logins on other services. This attack is highly effective because password reuse is extremely common. A single breach of a low-security site can compromise accounts at banking and email services if users reuse passwords.
The most practical path to high-entropy, memorable passwords is the passphrase: a sequence of four or more randomly chosen words from a large wordlist. The EFF's wordlist contains 7,776 words (6^5, one five-word roll of a six-sided die per word). A four-word passphrase from this list has entropy of 4 × log2(7776) ≈ 51.7 bits. A six-word passphrase has ≈ 77.5 bits — comparable to a 12-character random password from the full ASCII set, but far more memorable: "correct-horse-battery-staple" vs "xKp9!mN#2qRt".
The critical word is random. Choosing words that form a meaningful sentence or narrative reduces entropy significantly because the words are not independent. Use a random number generator, dice rolls, or a purpose-built passphrase tool.
The only practical solution to the problem of maintaining unique, strong passwords across hundreds of accounts is a password manager. A password manager generates cryptographically random passwords for every site, stores them in an encrypted vault, and auto-fills credentials so the user never sees or types the actual password. This eliminates password reuse and removes cognitive burden simultaneously.
Leading options include Bitwarden (open source, self-hostable), 1Password, and KeePassXC (offline, local vault). The master password protecting the vault should be a strong passphrase of six or more words — it is the one password worth memorizing.
Even a perfect password provides no protection if it is phished or if the service's database is breached and the hashing is weak. MFA adds a second factor that an attacker must also compromise: a TOTP code (Google Authenticator, Authy), a hardware security key (YubiKey, passkey), or a push notification. Enable MFA on all accounts that support it, prioritizing email, financial services, and identity providers. Hardware keys (FIDO2/WebAuthn) are phishing-resistant and represent the strongest commonly available second factor.
- Predictable complexity substitutions: p@ssw0rd, P@$$w0rd, S3cur1ty! — all in every cracker's ruleset.
- Personal information: Names, birthdays, pet names, addresses. Social engineering and LinkedIn make this information trivial to obtain.
- Password reuse: A breach of any one service exposes all services sharing that password.
- Short passwords: Anything under 12 characters is vulnerable to offline brute force with current hardware.
- Security questions: The answers are often guessable or available via social media. Use a password manager to generate random nonsense answers and store them.
For organizations configuring authentication systems, the 2024 NIST guidelines translate to these practical policies: require a minimum of 15 characters for all accounts; allow a maximum of at least 64 characters to support passphrases; do not impose character class complexity requirements beyond permitting all printable ASCII and Unicode; check new passwords against the HaveIBeenPwned Pwned Passwords database at creation and change; enforce account lockout or rate limiting on online authentication attempts; and require MFA for all privileged accounts and for access to sensitive data systems.
Password security is not about making passwords as complex and unreadable as possible — it is about making them long enough and random enough that attackers cannot practically find them, while keeping them practical enough that users do not resort to counterproductive workarounds. Long random passphrases, unique per-service passwords managed by a password manager, and MFA on important accounts will protect the vast majority of users from the vast majority of attacks. The science is clear; implementing it consistently is the challenge.