What makes a password strong?
A strong password is long and truly random. Attackers don't guess passwords one by one by hand; they use software that tries billions of combinations, starting with common words, names and patterns. A random password avoids all of those patterns, so the only way to crack it is to try every possibility.
| Password | Entropy | Strength |
|---|---|---|
| 8 lowercase letters | 38 bits | Weak |
| 12 mixed characters | 75 bits | Strong |
| 16 mixed characters | 100 bits | Very strong |
| 5-word passphrase | 52 bits | Fair |
| 7-word passphrase | 72 bits | Strong |
Password tips
- Use a password manager so you only need to remember one strong passphrase.
- Turn on two-factor authentication for important accounts.
- Never reuse passwords between sites.
- Change a password straight away if a service tells you it was involved in a data breach.
Passphrases use the EFF Short Wordlist by the Electronic Frontier Foundation, licensed under CC BY 3.0 US.
