"Make a strong password" isn't specific advice. Strong enough for what? A throwaway forum account and your online banking login don't deserve the same level of effort. The right question isn't "how strong" in the abstract — it's "how strong for this particular account's risk level."
Why one-size-fits-all advice fails
If you treated every password with maximum paranoia, you'd burn out and start cutting corners everywhere — including the accounts that matter. Security advice that ignores human behaviour produces worse outcomes in practice. The better approach: tier your accounts by what's actually at stake, and apply proportional effort.
Security experts have known this for years. The NIST Special Publication 800-63B (the US government's authoritative password guidance) no longer mandates regular password changes or extreme complexity rules — because the research shows users respond to those requirements by making predictable, weak modifications. Proportionality and uniqueness produce better real-world outcomes than blanket maximalism.
Understanding password strength: what entropy actually means
Password strength is measured in bits of entropy — a mathematical measure of how unpredictable a password is. Each bit of entropy doubles the number of passwords an attacker must try. A password with 60 bits of entropy requires 2⁶⁰ guesses (roughly 10¹⁸) to guarantee cracking, at which point even a nation-state-level GPU cluster running 10¹³ guesses per second would need 100,000+ years.
| Entropy | Example password | GPU crack time (10B/sec) | Assessment |
|---|---|---|---|
| < 28 bits | abc123 | Seconds | ❌ Critically weak |
| 28–40 bits | sunshine1 | Minutes–hours | ⚠️ Weak |
| 40–60 bits | Falcon$47 | Weeks–months | 🟡 Fair |
| 60–80 bits | Tr0ub4dor&3Falcon | Thousands of years | ✅ Good |
| 80–100 bits | 12-char random | Billions of years | ✅ Strong |
| 100+ bits | 16-char random | Astronomically long | ✅ Excellent |
Crack times assume an offline attack against a weak hash (MD5). Against modern password hashing (bcrypt at cost 12, Argon2id), the times are orders of magnitude longer. But you shouldn't rely on a website using strong hashing — you can't verify it. Design your passwords for the worst case.
Tier 1: Critical accounts — maximum strength required
These accounts can cause cascading damage if compromised. Email is the most dangerous: every other account can be reset via email, so a compromised inbox becomes a master key to your entire online life.
Accounts in this tier:
- ✓ Primary email account
- ✓ Banking and investment accounts
- ✓ Password manager master password
- ✓ Government / tax portals
- ✓ Healthcare portals
- ✓ Phone carrier account (SIM swap risk)
Requirements:
- → 16+ characters, all character types (uppercase, lowercase, numbers, symbols)
- → Entropy of 90+ bits — use our Password Generator set to 16 characters with all options enabled
- → Unique — never reused anywhere else, ever
- → Two-factor authentication is mandatory, ideally a hardware key (YubiKey) or TOTP authenticator app, not SMS
- → Change immediately if the service announces a breach
For your password manager's master password specifically, you cannot use a randomly generated password you can't memorise — use a 5-word Diceware passphrase or a two-word memorable password with a number and symbol. Aim for 65+ bits of entropy.
Tier 2: Important accounts — high strength
These accounts cause real inconvenience and potential financial exposure when compromised, but the damage is usually containable. A breached Amazon account is serious; it's not the same as a breached email account.
Accounts in this tier:
- ✓ Shopping sites with saved cards
- ✓ Social media accounts
- ✓ Work accounts and VPNs
- ✓ Cloud storage (Google Drive, Dropbox)
- ✓ Streaming services (shared billing)
- ✓ Ride-share and delivery apps
Requirements:
- → 12–16 characters, mixed character types — aim for 60+ bits of entropy
- → Unique per account — a breach at one should not compromise another
- → Enable two-factor authentication wherever available
- → Store in a password manager — you should never type these from memory
Tier 3: Low-stakes accounts — moderate strength
Forum logins, free newsletter sign-ups, a one-time account for a recipe site. A breach here exposes minimal personal information. The risk is primarily credential stuffing — if attackers get this password, they'll test it against Tier 1 and Tier 2 sites.
Requirements:
- → 10–12 characters is sufficient — about 50+ bits
- → Still unique — never reuse a "real" password here, even for low-stakes sites
- → A password manager makes this effortless: generate random, store automatically, never think about it again
The one rule that applies to every tier: uniqueness
Uniqueness matters more than raw strength once you clear a reasonable floor. A breach at a Tier 3 site doesn't threaten your bank account — unless you used the same password for both. Credential stuffing attacks exploit this exact vulnerability: automated tools test billions of leaked email/password combinations against every major service. If your passwords are unique, a breach at one site is self-contained.
This is why a password manager is the real unlock: it makes "unique for every account" effortless without requiring you to memorise anything. Once you have one, just generate maximum-strength passwords everywhere. Memorability stops being a constraint.
What about password length vs. complexity?
Length beats complexity. A 16-character lowercase-only random password has ~75 bits of entropy; an 8-character password with all character types has only ~52 bits. Modern password cracking tools (hashcat, John the Ripper) have rules that automatically try predictable complexity patterns — "P@ssw0rd" is cracked faster than "passwordpassword" because the substitution rules are well-known.
NIST's current guidance reflects this: they recommend length over complexity, and oppose arbitrary complexity requirements that lead users to predictable workarounds like appending "1!" to a word.
Common strength misconceptions
✗ Myth: Complex but short passwords are strong
✓ Reality: P@ss1! (7 chars) is cracked in milliseconds by GPU attacks. Length contributes exponentially more to entropy than character diversity.
✗ Myth: Changing passwords frequently improves security
✓ Reality: Forced rotation leads to weaker passwords (users append numbers). NIST recommends against mandatory periodic changes unless there's evidence of compromise.
✗ Myth: A password with symbols is always strong
✓ Reality: Sunshine! has a symbol but only ~35 bits of entropy. The predictable word dominates — the symbol barely increases the crack time.
✗ Myth: Personal information in a password makes it unique
✓ Reality: Your dog's name + birth year is unique to you, but both pieces of information are often publicly available or easily researched.
✗ Myth: A website's 'strong' meter means the password is safe
✓ Reality: Most site-based strength meters don't check for common patterns, dictionary words, or known breached passwords. They measure character diversity, not real-world crackability.
Frequently asked questions
Is a 12-character password strong enough?
For Tier 2 accounts with a password manager: yes. 12 random characters across all character types gives ~79 bits of entropy — far beyond what any realistic attack can crack against properly hashed passwords. For Tier 1 (email, banking), go to 16 characters for the margin against weak hashing or future advances.
Does adding a symbol at the end of a word make it strong?
No. 'Sunshine!' has low entropy because the word 'sunshine' is in every dictionary attack list. The ! adds less than 6 bits while the base word is highly predictable. Random character generation is fundamentally different from appending a symbol to a memorable word.
Should I use a passphrase instead of a password?
A 5-word diceware passphrase gives ~65 bits — strong enough for most purposes, and far easier to type and remember than a random character string. Passphrases are especially good for the accounts you type daily (device login, password manager master key). For accounts stored in a manager, random character passwords are slightly stronger for the same 'mental effort' (zero, since you don't memorise them).
How often should I change my passwords?
Only when: (1) a service you use announces a breach, (2) you suspect your device was compromised, or (3) you shared a password with someone who no longer needs access. Routine periodic changes without cause just make you more likely to choose weaker passwords.
What's the minimum password I should ever use?
10 characters with at least three character types, generating ~50+ bits of entropy. Below this, dictionary attacks and GPU-based brute force become realistic threats even against bcrypt-hashed databases.