Password Strength Math: Length Beats Symbols

There is a famous xkcd comic from 2011 about password strength. The character on the left is using "Tr0ub4dor&3" - a password with capital letters, numbers, a symbol, and enough complexity to satisfy any corporate IT policy. The character on the right is using "correct horse battery staple" - four random words. The punchline is that the first password has about 28 bits of entropy and the second has about 44, despite the first one looking much more secure.

I think about this comic every time I see a password policy that demands "at least one uppercase letter, one number, and one special character." That policy was designed for a threat model where attackers were guessing passwords by hand, one at a time. Modern attackers do not guess passwords; they run a wordlist of the top million leaked passwords through a hash function on a graphics card and try matches against a database dump. Against that threat model, the rules about character classes are almost meaningless. The only thing that matters is how big the search space is, and the search space is dominated by length, not by complexity.

The math, briefly

Password strength is measured in bits of entropy. One bit doubles the search space. A password drawn from a pool of N possible characters and L characters long has roughly L * log2(N) bits of entropy.

For random characters from a-z only (26 characters), each character is about 4.7 bits. A 12-character lowercase password is about 56 bits. For mixed-case + digits + symbols (about 94 printable ASCII), each character is about 6.6 bits, so a 12-character password from that alphabet is about 79 bits.

For a four-word passphrase drawn from a 7,776-word dictionary (the EFF wordlist), each word is about 12.9 bits, so four words is about 51 bits.

For context, 50 bits of entropy takes a well-funded attacker a few weeks to brute-force at modern hardware speeds. 70 bits takes years. 100 bits is uncrackable for practical purposes. So the threshold you want for important accounts is 70-100 bits, which translates to either ~12 random characters from a mixed alphabet, or ~6 words from a good wordlist.

Why "P@ssw0rd!" is laughably weak

Modern password crackers do not iterate through every possible character combination. They start with the top 1,000 most common passwords (which catches the majority of breached accounts immediately), then run wordlists with common transformations: appending a digit, capitalizing the first letter, replacing 'a' with '@' and 'o' with '0', adding a year at the end. The transformation rules are exhaustive. "P@ssw0rd!" is on every cracker's first-pass wordlist; it would be cracked in under a second.

The same is true for "Sunshine2024," "Iloveyou123," and any password derived from a dictionary word with predictable substitutions. The lesson: humans are bad at random. Random has to come from a machine.

The credential stuffing attack

Here is the threat model that makes password reuse catastrophic. When a website gets breached - which happens regularly, sometimes to enormous services - the attacker walks away with a list of usernames, email addresses, and password hashes. They crack the hashes (the easy ones in seconds, the harder ones over days) and now they have a list of working email-and-password pairs.

Credential stuffing is what happens next. The attacker takes that list and tries every pair against every other major service: Gmail, Facebook, Amazon, your bank. Most users reuse passwords across sites, so a hit rate of even 1% means thousands of compromised accounts on services that were never breached themselves. The breach at one site cascades through your entire online life.

The defense is uniqueness, not strength per se. If every account has a different password, a breach at one site cannot affect any other site. This is the actual reason password managers exist - not because individual passwords are too hard to remember, but because the number of different passwords you need is too many.

What I personally do, and recommend

The setup I have used for years and recommend:

Use a password manager. 1Password, Bitwarden, and KeePass are the main contenders. I use Bitwarden because it is open-source and the free tier is generous; 1Password has a nicer UI if you do not mind paying. The "built-in" password manager in browsers (Chrome, Safari, Firefox) is fine for low-stakes accounts but lacks features for serious use.
Generate every password. Let the manager (or a separate tool like the Toolium Password Generator) produce a 20-character random string for every new account. Don't try to remember any of them; you have the manager for that.
Make the master password long and unique. Six or seven random words from a long wordlist is a good shape. The master password should be the longest password you have anywhere because losing it is catastrophic.
Enable 2FA everywhere it is offered. Even a strong unique password is not enough if it leaks. 2FA with an authenticator app (Authy, Google Authenticator, the built-in 2FA in 1Password and Bitwarden) is the second factor most services use. SMS-based 2FA is better than no 2FA but should be treated as a fallback, not a primary; SIM-swap attacks defeat it.
Check your accounts against Have I Been Pwned occasionally. The service maintains a database of leaked credentials. If your email shows up in a breach, change the password on the affected service immediately.

How the Toolium Password Generator works

The tool uses the browser's crypto.getRandomValues API, which pulls from the operating system's cryptographic random source. On macOS that is the /dev/urandom-equivalent that mixes entropy from hardware random number generators and system events. On Windows it is CryptGenRandom. The randomness is "real" in the sense that you cannot predict the next byte even if you know all the previous ones - this is what cryptographic-grade random means.

This is not pseudo-random like Math.random(), which uses a deterministic algorithm and can be predicted given enough samples. Math.random() should never be used for anything security-related.

The generator runs entirely in your browser. Nothing leaves the page. The generated passwords are not stored in localStorage, not sent to any server, not logged anywhere. When you close the tab, they are gone unless you copied them somewhere first. This is the right architecture for a password generator - the alternative (server-side generation) would be madness.

Tool options, and what to actually pick

The Toolium generator has knobs for length, character classes (uppercase, lowercase, numbers, symbols), and "avoid ambiguous characters" (excludes 0, O, 1, l, I to make passwords easier to read off a printout).

For most accounts, the default - 16 characters, all four character classes on - is plenty. For very high-stakes accounts (your password manager master password, your email account), go to 20 or more characters. For passwords you will need to type frequently rather than copy-paste, consider longer-but-pronounceable: turn off symbols, turn on "avoid ambiguous" to make the password easier to handle.

A few myths, briefly debunked

"Rotating passwords every 90 days makes you more secure." NIST officially walked back this advice in 2017. Forced rotation makes users pick predictable patterns (Password1 → Password2 → Password3). Only rotate when there is evidence of compromise.
"My password is safe because I have 2FA." 2FA is a great backup but does not excuse a weak password. If your password is also weak, an attacker who gets past the 2FA (via phishing, SIM swap, session token theft) has trivial access.
"Password managers are a single point of failure." Technically true, but the failure mode is far less likely than the failure mode of reusing weak passwords. The math favors the password manager unless you are an unusually high-value target.
"Long passwords are inconvenient." They are inconvenient to type, sure. They are not inconvenient to use through a password manager, which is the right way to use them. The convenience problem is solved by the manager, not by the password.