For years, "complexity" rules dominated password advice: at least one uppercase letter, one number, one symbol. But modern security research points to a different conclusion — length matters far more than complexity. Here's the math behind why, and what it means for the passwords you actually use.
What "complexity" actually means
Complexity refers to the variety of character types in a password — mixing uppercase, lowercase, numbers, and symbols. The idea is that more variety means more possible characters at each position, which makes guessing harder. This is true, but it's only half the picture, and it's the smaller half.
What length actually means
Length refers to how many characters are in the password. Each additional character multiplies — not adds to — the total number of possible combinations. This compounding effect is why length has a dramatically larger impact on security than complexity does.
The math: comparing length vs complexity
| Password style | Length | Character types | Approx. entropy |
|---|---|---|---|
| Complex but short | 8 chars | All 4 types | ~52 bits |
| Simple but long | 16 chars | Lowercase only | ~75 bits |
| Long and complex | 16 chars | All 4 types | ~104 bits |
| Very long, simple | 24 chars | Lowercase only | ~113 bits |
Notice that a 16-character password using only lowercase letters (~75 bits) is already stronger than an 8-character password using every character type available (~52 bits). Length wins even without any complexity at all. Want the full technical explanation of entropy and bits? Read our password entropy guide.
Why complexity rules can backfire
Strict complexity requirements often push people toward predictable patterns: capitalizing the first letter, adding "1" or "!" at the end, substituting "3" for "e." Attackers know these patterns well, and password-cracking tools test them first. The result is a password that technically satisfies a complexity rule but isn't meaningfully harder to guess than a simpler one — while also being harder for you to remember.
The best approach: use both, but prioritize length
The strongest passwords combine generous length with full character variety, which is exactly what a random password generator produces. If you have to choose where to compromise — for a system with awkward restrictions, for example — favor extra length over extra symbol variety every time.
- Minimum for most accounts: 12–16 characters, mixed character types
- High-value accounts (banking, email, password manager): 16–20+ characters
- If forced to choose: always pick more length over more symbol variety
Generate a password with both length and complexity
Skip the manual tradeoff entirely — our generators create passwords with maximum length and full character variety in one click. Try the 16-character generator, 20-character generator, or the main Password Generator with fully customizable length and character options.