Password advice has been stuck for twenty years on rules that feel rigorous and do very little. One uppercase, one number, one symbol, changed every ninety days: that produces Summer2026! on millions of accounts. Attackers know the rules too, and their software applies them before it tries anything else.
Randomness is the only thing that counts
The strength of a password is how many equally likely possibilities it could have been. That is measured in bits of entropy, where each extra bit doubles the guessing work. A password drawn at random from 72 possible characters carries about 6.2 bits per character, so a 16-character random string is around 99 bits: far beyond brute force.
The catch is the word random. If you chose the characters yourself, the number is much lower, because people reach for names, dates, keyboard patterns and predictable substitutions. Entropy measures the process that produced the password, not how complicated it looks.
Why substitutions do not help
Replacing letters with symbols, capitalising the first letter and adding a number at the end are all patterns that cracking tools apply automatically to dictionary words. P@ssw0rd1 is not meaningfully harder to guess than password. The transformation is public knowledge, so it adds almost nothing.
Passphrases work, if the words are random
Five words chosen at random from a list of 7,776 give about 64 bits, which is strong and far easier to remember than a random string. The requirement is that a random process picked the words. A memorable phrase you composed yourself, or a line from a song, has far less entropy than its length suggests.
Reuse is the bigger risk
Most accounts are not lost to brute force. They are lost because a password leaked from one site and was tried on every other. This is credential stuffing, it is cheap, and it works. A unique password per account contains the damage to the site that leaked, which is why a password manager matters more than any individual password rule.
What to do
Use a password manager and let it generate a different random password for every account. Make the master password a long random passphrase you can actually remember. Turn on two-factor authentication wherever it is offered, preferring an app or a hardware key over SMS. Change a password when there is a reason, such as a breach notice, rather than on a calendar: forced rotation mostly produces predictable variations.
The password generator uses your browser’s cryptographic randomness and shows the entropy of whatever settings you choose, so you can see how much difference length actually makes.