The difference between a strong password and a weak one isn't a matter of opinion — it's measurable in exact time-to-crack estimates. A weak 6-character password can be broken in milliseconds. A strong 16-character random password would take billions of years. Understanding what specifically makes a password strong or weak empowers you to make better security decisions and recognize when a "clever" password is actually still vulnerable.
Anatomy of a Weak Password
Weak passwords share predictable characteristics. They're not just "short" or "simple" — they contain structural patterns that password cracking tools are specifically designed to exploit. Here are the specific failure modes:
1. Brevity
Short passwords have too few possible combinations. A 6-character password using only lowercase letters has 26⁶ = approximately 309 million possible combinations. That sounds like a lot, but a modern GPU can test over 10 billion passwords per second, meaning it cracks a 6-character lowercase password in less than a second. Each additional character multiplies the time exponentially: an 8-character password takes minutes; a 12-character password takes years; a 16-character password takes billions of years.
2. Dictionary Words and Common Phrases
Dictionary attacks don't try all possible character combinations — they start with lists of real words, names, and phrases that humans actually use. Password cracking tools come with dictionaries containing millions of entries: English words, names, cities, sports teams, song lyrics, movie titles, and more. A password like "sunshine," "dragon," or "princess" is in every cracking dictionary and will be found instantly, regardless of its character count.
Importantly, these dictionaries include predictable variations: "sunshine1," "SUNSHINE," "Sunshine2024," "sunsh!ne," "@sunshine." Adding numbers or capitalizing letters does very little when the base word is in the attacker's dictionary with rules applied.
3. Personal Information
Passwords incorporating personal information — your name, spouse's name, children's names, pets, birthdate, anniversary, hometown, favorite team — are weak even if they seem private. Targeted attackers research targets before attacking, gathering information from social media, public records, and data broker profiles. What seems private to you may be publicly available.
Additionally, this information is often added to cracking dictionaries derived from the specific data breach being attacked. If your name and birthday were in the database alongside your password hash, they'll be tried as password candidates first.
4. Predictable Patterns
Human beings are profoundly bad at generating randomness. When we try, we follow unconscious patterns: putting the capital letter first, putting numbers at the end, clustering vowels and consonants in phonetically natural ways, avoiding repeated characters, using keyboard patterns like "qwerty" or "12345." Modern password cracking rulesets explicitly target these human patterns.
Common patterns that crackers explicitly try: First letter capitalized + word + year (Batman2024), Word + special character (password!), Keyboard rows (qwerty, asdfgh, zxcvbn), Letter-number substitutions (passw0rd, h3llo, m@il), Sequential numbers at end (password123, password456).
5. Reuse Across Sites
A password can be perfectly random and long but still be effectively weak if it's used on multiple sites. The moment any site using that password suffers a breach, the password is compromised everywhere. Password uniqueness isn't a property of the password itself but of how it's deployed — and a non-unique password provides zero additional protection for subsequent accounts.
Examples of Weak Passwords (and Why They Fail)
123456— The world's most common password. Cracked instantly by any attack.password— In every dictionary. Cracked instantly.P@ssw0rd!— Letter substitutions of "password." In every cracking ruleset. Cracked in seconds.Sarah1990!— Name + birth year + symbol. Targeted attacks guess this within minutes.Summer2024— Season + year pattern. Extremely common, cracked quickly.qwerty123— Keyboard pattern + numbers. One of the most common passwords globally.iloveyou— Common phrase. In every dictionary.Anatomy of a Strong Password
A strong password has two core properties: length and genuine randomness. Everything else — complexity, variety, avoiding personal info — derives from these two foundations. Here's what strong passwords look like and why they work:
Genuine Randomness
True randomness means no pattern, no bias, no predictability. Each character is selected independently with equal probability from the allowed character set. This eliminates the entire class of pattern-based attacks. Dictionary attacks fail because there's no word. Rule-based attacks fail because there's no pattern. Targeted attacks fail because there's no personal information.
Genuine randomness is impossible for humans to produce reliably — but cryptographic password generators achieve it using your device's hardware entropy sources. Our generator uses crypto.getRandomValues(), producing mathematically guaranteed unpredictability.
Sufficient Length
Even with randomness, very short passwords can eventually be brute-forced. Length adds an exponential barrier: every additional character multiplies the number of possible passwords by the size of the character set (around 90 for a full character set). At 16 random characters, the total combinations reach approximately 53 quadrillion — requiring billions of years to exhaust even with the fastest cracking hardware.
Examples of Strong Passwords
9mK$vB#2nPqR@xT5— 16 chars, fully random, all types. Estimated crack time: billions of years.Xq7!mN3@kHp2&wVz— 16 chars, fully random. No pattern to exploit.correct-horse-battery-staple-moon— 5 random words passphrase. 35 chars, easy to remember, extremely strong.J4$tKpRm9@hNvWy2qX— 18 chars, fully random. Effectively uncrackable by any known method.The Comparative Analysis: Crack Time by Password Type
| Password | Type | Crack Time |
|---|---|---|
| 123456 | Common sequence | Instant |
| password | Dictionary word | Instant |
| P@ssw0rd! | Dict + substitutions | Seconds |
| Summer2024! | Pattern + year | Minutes |
| Tr0ub4dor&3 | Complex word pattern | Days |
| xK7@mN2!pQ | 10 chars, random | Months |
| 9mK$vB#2nPqR@xT5 | 16 chars, fully random | Billions of years |
Estimates based on 10 billion attempts per second against a fast hashing algorithm. Times are dramatically longer against modern bcrypt/Argon2 hashing.
Common Myths About Password Strength
Myth 1: Adding numbers and symbols to a word makes it strong
Reality: Password cracking rulesets automatically apply hundreds of number/symbol variations to every dictionary word. "Dragon," "Dragon1," "Dragon123," "Dr@gon," "dr@g0n" — all are tested automatically in seconds. Letter substitutions and number additions do not meaningfully increase resistance to dictionary attacks.
Myth 2: A complex 8-character password is strong enough
Reality: At 10 billion attempts per second, an 8-character password with all character types can be exhaustively cracked in under 10 hours — less time than you sleep. Eight characters was considered adequate in 2010 when typical cracking hardware was thousands of times slower. Modern hardware demands minimum 12-14 characters for any meaningful security.
Myth 3: Changing your password frequently is more important than making it strong
Reality: NIST's current guidelines (SP 800-63B) explicitly state that mandatory periodic password changes should not be required unless there's evidence of compromise. Frequent rotation encourages weak, predictable patterns (people cycle through variations of the same password). A randomly generated 16+ character password doesn't need regular rotation — its strength makes time-based attacks irrelevant.
Myth 4: Using a phrase makes a password secure
Reality: It depends. A phrase from a book, song, or movie is potentially in cracking dictionaries. "iloveyoubaby" or "tobeornottobe" will be tried quickly. A passphrase of genuinely random unconnected words ("correct horse battery staple") is actually very strong because its length compensates for using only word-level randomness. "Ilikepizzaonmondays" is not strong; "coffee-umbrella-river-jacket-seventeen" is.
Practical Guidance: Building Your Password Standard
Based on what we know about how cracking actually works, here's a practical standard for different account types:
- Password manager master password: 5+ random word passphrase you can memorize
- Email accounts: 18-20 character random password — this protects everything else
- Banking and financial: 16-20 character random password + MFA
- Social media: 16 character random password + MFA
- Shopping and low-risk accounts: 14-16 character random password
- One-time accounts you won't use again: 14+ character random password
The common thread: all passwords should be randomly generated, never human-crafted. The character count varies by risk level; the randomness requirement is universal.