What entropy actually measures
Password strength is usually expressed in bits of entropy — a count of how many equally-likely secrets could have been generated the same way. It is not a description of the password itself; two different-looking passwords generated by the same method carry the same entropy, because entropy measures the size of the haystack, not which straw you happened to pick.
The pool size is the number of distinct characters (or words) each position could have been drawn from. Every extra character multiplies the number of possible outputs by the pool size, and because bits are logarithmic, each extra character adds a fixed number of bits rather than a fixed percentage. That additive relationship is the whole story of why length dominates.
Worked example — a generated character password
A password drawn from lower-case, upper-case, digits and symbols (with the look-alike characters I, l, 1, O, 0 excluded to keep it readable) uses a pool of 68 characters: 25 lower-case letters, 23 upper-case letters, 8 digits and 12 symbols. At 20 characters, that is 20 × log₂(68) ≈ 122 bits — comfortably beyond anything worth attacking directly. Drop the digits and symbols and use only the 48-character letters-only pool at 16 characters, and you still get 16 × log₂(48) ≈ 89 bits — fewer symbol types, made up for by more characters.
Why length beats complexity rules
Compare two moves: adding a symbol requirement to an 8-character password, versus simply typing two more characters. Widening the pool from, say, 62 characters (letters and digits) to 74 (adding 12 symbols) multiplies the number of possible passwords by roughly (74/62) per character — a modest gain applied once. Adding two more characters to the length multiplies the possibility space by the pool size twice over, which for a 62-character pool is a factor of nearly 4,000. Length is a multiplier applied per character; a wider alphabet is a one-off multiplier applied to the whole scheme. Beyond a certain point, forcing "at least one symbol, one number, one capital" barely moves the entropy needle, and in practice it makes people do something predictable — capitalise the first letter, add "!" at the end — which an attacker's cracking dictionary already expects. A composition rule that shapes behaviour into a predictable pattern can cost more real strength than it adds.
What the guidance bodies actually say
This isn't a fringe opinion. The UK's National Cyber Security Centre recommends building passwords from three random words, arguing that a memorable combination of unrelated words gives people a password they can actually use without resorting to weak, predictable patterns or writing it on a sticky note. NCSC's own reasoning is behavioural as much as mathematical: a rule that is too hard to follow gets worked around.
The US National Institute of Standards and Technology reached a similar conclusion from a different angle. NIST SP 800-63B, the digital identity guideline that much of the industry treats as the reference standard, tells verifying systems to allow long passphrases (at least 64 characters), to stop imposing composition rules such as mandatory mixes of character types, and to stop forcing periodic password changes with no evidence of compromise. The rationale given is direct: composition rules and forced rotation push users toward predictable, incremental changes to existing passwords rather than genuinely new, strong ones — and the security benefit doesn't justify the friction.
Offline attacks versus online attacks
How much entropy you actually need depends heavily on what an attacker can do with a guess.
- Online attacks go through the real service — typing a guess into a login form, or hitting an API. A well-run service rate-limits failed attempts, locks accounts after a handful of tries, or requires a CAPTCHA, capping an attacker at perhaps a few thousand guesses before detection. Under those constraints, even a modest passphrase is effectively unbreakable within a human lifetime.
- Offline attacks happen once an attacker has stolen a database of password hashes and can guess against a copy on their own hardware, with no rate limit at all. Modern GPU rigs can attempt many billions of guesses per second against a fast hash. This is the scenario entropy calculations are really protecting against, and it is why the security margin you want for a master password or disk-encryption passphrase is much larger than for an average login.
The practical takeaway: your password manager's own master password and your device's disk encryption deserve the strongest passphrase you're prepared to type, because if that particular secret leaks as a hash, it will be attacked offline. Ordinary website logins can be a little shorter, because the service itself is the rate limiter.
Passphrases versus generated strings
A passphrase built from dictionary words and a random character password both derive their strength from the same formula — entropy per unit, multiplied by the number of units — they just choose different units. A password draws characters from a pool of dozens; a passphrase draws whole words from a list of thousands, so a single word is worth far more bits than a single character.
A four-word passphrase drawn from the 7,772-word EFF Long Wordlist, capitalised and joined with hyphens, with a trailing digit and symbol, carries about 59 bits — each word contributes log₂(7,772) ≈ 12.9 bits, and the appended digit and symbol add a little more on top. Six words with no trailing extras reach roughly 78 bits, comfortably into offline-attack territory, while still being something a person can read aloud, remember, and type without a manager. The trade-off is genuinely different from a generated string, not just cosmetically: a password like x9$mK2!qLp8v has to be stored somewhere, because no one commits it to memory reliably, while a passphrase is designed to be memorised.
Password managers
The practical answer to "which do I use" is usually both, for different jobs. A password manager can hold a long, fully random, unique password for every account you have — you never need to type or remember most of them, so there's no reason to compromise on length or make it pronounceable. That leaves a small number of secrets you genuinely have to carry in your head: the manager's own master password, your device login, perhaps a disk-encryption key. Those are exactly the cases a passphrase suits, because they combine a need for real memorability with, in the master-password case, real exposure to offline attack if the vault is ever stolen.
Reusing a password across sites is a separate risk from weak entropy, and no amount of length fixes it: if one service is breached and the password leaks in plain text (or is cracked from a weak hash), every other account using that same password is compromised immediately. A manager's real value is generating and remembering a unique secret per site, so a single breach cannot cascade.
Frequently asked
How many bits of entropy is "enough"?
There's no single number, because it depends on what's rate-limiting the attacker. For an online login protected by lockouts or rate limits, well under 60 bits is already impractical to brute-force. For anything that could be attacked offline — a master password, a disk-encryption passphrase, a hash that could leak in a breach — aim higher, comfortably above 70–80 bits, which a five- or six-word passphrase reaches easily.
Does adding a number and a symbol to a passphrase help much?
A little, but not as much as another word. Appending a digit adds roughly log₂(10) ≈ 3.3 bits; a symbol from a typical set adds a few more. A whole extra word from the EFF list adds about 12.9 bits — several times as much. If a site insists on a digit or symbol, add one; if you want more real strength, add a word instead.
Is it still worth changing passwords regularly?
Not on a fixed schedule, according to current guidance. NIST SP 800-63B specifically advises against mandatory periodic rotation absent evidence of compromise, because it tends to produce small, predictable variations on the same password rather than genuinely new ones. Change a password when you have a real reason — a breach notification, suspicious activity, or reuse you want to eliminate — not on a calendar.
Are these numbers what the password generator on this site produces?
Yes — the entropy figures above come directly from the same fixtures that drive our password generator, so the numbers you see there match this guide exactly. Read more about that approach on how we build and verify our tools.