Secure Passwords: Why Length Matters More Than Complexity

We think we're doing the right thing by adding uppercase letters and symbols. In reality, a longer password - even one made entirely of lowercase letters - is mathematically more secure. Here's why, what length to aim for, and how to create a truly secure password.

Is a Long Password Better Than a Complex One?

Length beats complexity. It's counterintuitive, but the numbers speak for themselves.

Let's compare three passwords:

• 8 characters, lowercase only (26 possibilities per position): 26⁸, or about 208 billion combinations
• 8 characters, all types combined - lowercase, uppercase, numbers, and symbols (95 possibilities per position): 95⁸, or about 6.6 trillion combinations
• 16 characters, lowercase only: 26¹⁶, or about 43 quintillion combinations

The third password - the simplest-looking one - is incomparably more resistant than the other two. Each additional character multiplies the possibility space exponentially, whereas adding character types produces only a linear gain.

What Length Makes a Password Secure?

Aim for at least 12 characters for everyday use, and 16 or more for sensitive accounts: primary email, banking, and your password manager. Below 12 characters, a password becomes vulnerable to an offline attack on a stolen database.

The reason comes back to the math above: extra characters, far more than extra character types, are what drive up the number of combinations. A 16-character lowercase password is already out of reach for a brute-force attack. There's no need to chase complicated rules - making your password longer beats making it more complex.

How Do You Create a Secure Password? A Practical Example

The right approach depends on the use case. For passwords you need to memorize - your password manager's master password, your login session - use a passphrase: a string of random words that's long and easy to remember. For everything else, let a generator produce a random password you'll never need to memorize.

Here's what that looks like in practice:

• A passphrase: "sardine galaxy tambourine velvet pirate" (five randomly chosen words, easy to remember, extremely hard to crack)
• A generated password: "GD€75€!RPF]HT" (random, stored in the password manager, never typed from memory)

And what to avoid:

• A dictionary word, a first name, or a date: "Julian2024", "Password!"
• A "clever" substitution: "P@ssw0rd" (see the next section)
• The same password reused across multiple sites

One important note: these examples are for illustration only. Never reuse them - a password published anywhere is no longer secret. The best approach is always to let a generator handle the randomness for you, since the human brain is simply not capable of it. Octopussian's password manager includes exactly such a generator.

Why Replacing Letters With Symbols Doesn't Help

Swapping an "a" for "@", an "o" for "0", or an "e" for "3" is a false sense of security. These substitutions have been known for decades and are built into every modern cracking tool. "P@ssw0rd" is not meaningfully more resistant than "password" against an automated attack.

This habit creates an unjustified feeling of security. It comes from early cybersecurity recommendations, from a time when attack tools were far less sophisticated. Today, a genuinely long and random password is far better than a short password dressed up with symbols.

What Is a Passphrase and Why Is It Effective?

A passphrase is a string of random words used as a password - for example, "horse battery staple mountain cactus." It's long, robust, and easy to remember.

The entropy of a 5-to-6-word passphrase drawn from a 7,776-word dictionary (the Diceware method) is comparable to that of a random 10-to-12-character password. Memorability, however, is incomparably easier.

Passphrases are particularly well-suited for a password manager's master password - the one you actually need to remember. For everything else, a generator is the better choice: it produces cryptographically random output without human bias, something the brain simply can't replicate.

Should You Change Your Password Regularly?

No. Periodic password rotation has been officially discouraged since 2017 by NIST, the U.S. standards body for cybersecurity.

The history here is worth knowing. In 2003, Bill Burr - then a NIST employee - authored Special Publication SP 800-63, which became a global reference. It recommended mandatory complexity rules and password changes every 90 days. In 2017, after retiring, he publicly acknowledged that those recommendations were based on 1980s assumptions, with no solid empirical data behind them.

The problem with forced rotation is real: it pushes users toward predictable variations - "January2024", "January2024!", "February2024!". That's exactly the pattern attackers test first.

A good password has no expiration date. Change it only when a compromise is confirmed or suspected.

Why You Should Never Reuse a Password

Because billions of username/password pairs from data breaches are freely circulating online. Attackers test them automatically across dozens of services - this is credential stuffing.

If you use the same password for your email and a forum that was breached three years ago, your email is potentially compromised. And email is often the master key to everything else: it's where all the "forgot your password" links for your other accounts are sent.

The only defense: one unique password per service, no exceptions. This is what makes a password manager practically indispensable - no one can memorize dozens of long, random passwords.

Services like Have I Been Pwned (haveibeenpwned.com) let you check whether an email address or password appears in a known compromised database. That's an objective way to decide whether to change a password - without waiting for an arbitrary rotation schedule.

Is a Strong Password Enough to Stay Protected?

No. Several attack vectors make the intrinsic quality of a password irrelevant.

Shoulder surfing - someone glancing over your shoulder in an open office or on public transit - is underestimated because it doesn't look like a cyberattack. A keylogger, whether hardware or software, captures your password before it even reaches the server. And phishing tricks users into entering their password on a fraudulent site themselves: in that scenario, length and complexity are completely beside the point.

These realities make the case for a layered approach: a strong password is necessary but not sufficient. Two-factor authentication and phishing awareness round out the defense.

What's the Difference Between an Online and Offline Attack?

This is a fundamental distinction that drastically changes the level of security required.

In an offline attack, the attacker has obtained a copy of the database - through a breach or a stolen backup. They work locally, with no external limitations. With a modern GPU, they can test billions of combinations per second against an MD5 hash, or hundreds of millions against bcrypt. Only password length and hashing quality make a difference at that point.

In an online attack, every attempt goes through the network and the server. Defensive mechanisms shift the equation: progressive delays between attempts, temporary lockouts after failed tries, CAPTCHAs, and suspicious IP detection. With a simple one-second delay between attempts, a 10-character password becomes practically uncrackable.

A properly protected online service can tolerate a reasonably shorter password than a file that might be exfiltrated and attacked offline.

How Does a Server Protect Stored Passwords?

In the event of a database breach, the hashing algorithm determines how resistant passwords are. Not all algorithms are equal.

MD5 and SHA-1 are obsolete: they can be cracked at billions of attempts per second. Bcrypt, deliberately designed to be slow, remains a proven standard with an adjustable computational cost. Argon2, winner of the Password Hashing Competition in 2015, is today's recommendation: it resists GPU-based attacks and attacks using specialized hardware (ASICs).

Salting completes the picture: by adding a unique value to each password before hashing, it ensures that two users with the same password produce different hashes. This neutralizes rainbow table attacks.

Why Do Some Sites Impose Absurd Password Rules?

Because their systems don't handle passwords correctly on the server side. A maximum length of 10 or 12 characters, a ban on certain special characters, or rejection of certain combinations "for security reasons" often signals that passwords are stored in plaintext or hashed poorly.

A properly hashed password - using bcrypt or Argon2 - has no reason to be limited in length. If a service prevents you from using a long, random password, that's a red flag about the overall quality of its security.

Why Is Password Security a Collective Issue in the Workplace?

Because a single compromised account can expose an entire shared workspace: colleagues' data, customer data, and the company's reputation.

A team member who secures their access to a task management tool carelessly might think the stakes are low. But that tool potentially contains specifications, client communications, and information about internal architecture. An attacker who gets in through that door can move laterally toward far more sensitive targets.

Password security within a team is a shared responsibility. That's what justifies administrative features in a password manager: enforcing minimum requirements, verifying that every team member has enabled two-factor authentication, and being able to revoke access quickly without depending on individual goodwill.

Key Takeaways

• Prioritize length over complexity: 16 lowercase characters are stronger than 8 characters of every type.
• Aim for at least 12 characters, and 16 or more for sensitive accounts.
• Use a passphrase for what you need to remember, a generator for everything else.
• Don't change passwords out of routine: NIST has officially discouraged it since 2017.
• One unique password per service: credential stuffing exploits reuse at scale.
• In a team context, this is a collective issue: one weak account puts everyone at risk.