Passwords are the most common authentication mechanism in existence, and also one of the most consistently misunderstood. Most people have been taught that a strong password needs uppercase letters, numbers, and symbols. That guidance is not wrong exactly, but it is incomplete, and in some ways it produces worse behavior than it prevents. Understanding what actually makes a password strong requires looking at how attackers break them.
How Attackers Approach Password Cracking
Attackers rarely sit at a keyboard and guess passwords manually. They use automated tools that can test billions of combinations per second against captured password hashes. The two most common methods are brute-force attacks, which try every possible combination of characters up to a given length, and dictionary attacks, which test known words, common substitutions, and previously leaked credentials.
This is the frame that matters. A password is strong if it takes an automated system a prohibitively long time to find it. Everything else follows from that.
Length Is the Primary Factor
The single most effective property of a strong password is length. Every character added to a password multiplies the number of possible combinations an attacker has to test. A random eight-character password that meets classic complexity rules is meaningfully weaker than a random fifteen-character password that does not, simply because of the search space involved.
NIST Special Publication 800-63B recommends a minimum of eight characters for user-created passwords but explicitly encourages longer passwords and passphrases. NIST also advises that systems allow passwords up to at least 64 characters, so that users who want to create long passphrases are not artificially blocked from doing so.
A passphrase, a sequence of several random words strung together, can be both long and memorable. "correct horse battery staple" is a well-known illustration of this principle: it is long, has high entropy, and is easier to remember than "C0rr3ct!" while being considerably harder to crack.
Randomness and Unpredictability
Length alone is not enough if the content is predictable. Dictionary attacks succeed precisely because people choose passwords that reflect patterns: names, dates, sports teams, common words with predictable substitutions (the letter "a" replaced with "@", for instance). Attackers build wordlists from billions of real passwords exposed in prior breaches, and those lists include virtually every common substitution pattern.
Unpredictability means the password cannot be derived from publicly available information about the user, does not follow a common pattern, and ideally was generated randomly rather than chosen. A password manager generating a random string of characters, or randomly selecting words for a passphrase, produces credentials that are meaningfully more resistant to dictionary-style attacks than anything a person would invent under time pressure.
What NIST Says to Stop Doing
The 2017 revision to NIST 800-63B represented a meaningful shift in official guidance. NIST moved away from several practices that had become standard but that research had shown to be counterproductive:
- Mandatory periodic password rotation without evidence of compromise, because it tends to produce minor, predictable variations rather than genuinely new credentials
- Mandatory complexity rules requiring uppercase, numbers, and special characters in specific positions, because they push users toward predictable patterns rather than genuine randomness
- Password hints and security questions, because they often expose information that an attacker could find or guess
What NIST recommends instead: check new passwords against lists of known compromised credentials, allow longer passphrases, and avoid arbitrary complexity requirements that frustrate users without meaningfully improving security.
CISA aligns with this direction, recommending long, unique passwords and the use of password managers.
The Role of Uniqueness
A technically strong password that is reused across multiple sites creates a systemic vulnerability. When one site experiences a breach and credentials are exposed, attackers run those credentials against other services automatically. This is credential stuffing, and it is effective because password reuse is common.
Uniqueness means each account has its own credential. A password manager makes this practical: users do not need to remember dozens of distinct random strings, only the master credential for the manager itself.
Where Password Strength Fits in a Broader Security Posture
Passwords are one layer of a credential security model, not the whole model. Even a strong, unique password can be phished or exposed in a breach. This is why multi-factor authentication sits on top of password-based authentication in most security frameworks: it reduces the damage that a compromised credential alone can do.
Strong passwords reduce the risk of brute-force and dictionary attacks succeeding. MFA reduces the risk of a stolen credential being sufficient on its own. Both matter, and they address different parts of the problem.
For anyone building or evaluating an authentication system, the practical baseline is: enforce a meaningful minimum length, check against known breach lists, allow passphrases, avoid counterproductive complexity rules, encourage or require a password manager, and layer MFA on top.