How to Create a Strong Password: Length Is the Secret
In this article
The secret of a strong password is length, much more than complexity. Cyber attackers do not try passwords one by one; they use automated tools that try billions of combinations in a short time. A short, complex password is easier prey for these tools. A long but simple passphrase made of a few words is easy to remember and much harder to crack.
How do attackers crack passwords?
When a password is captured or a site's password database leaks, attackers use automated tools to try every likely combination. These tools prioritise common words, passwords from known leaks and predictable patterns such as "numbers in place of letters".
That is why a password like "P@ssw0rd!" may look complex but is easy for an attacker: it is short and fits a known pattern.
What is a passphrase?
A passphrase is a long password made of several words. A phrase such as "Spotty-cat-sleeps-on-the-balcony-Sunday-morning" means something to you and is unguessable for anyone else.
The maths is simple: every extra character multiplies the number of combinations that have to be tried. An eight-character complex password can be cracked quickly with powerful hardware, while cracking a simple twenty-five-character phrase takes impractically long.
What makes a good passphrase
- It has at least four or five words.
- The words are not logically related to each other.
- It is not a famous quote, song lyric or proverb.
- It contains no personal details such as your name, date of birth or company name.
- It is different for every account.
Length alone is not enough
You need a different password for every account. A data breach on a single site puts every account where you use the same password at risk. The first thing attackers try is testing leaked passwords on other popular services. This is called credential stuffing.
If you use the same password for your work account and a personal account, a leak on an unrelated site becomes a direct risk for your company.
Complete it with a password manager and MFA
You do not have to keep all your passwords in your head. A password manager stores your passwords in an encrypted vault and fills them in automatically when you need them. The only thing you have to remember is the vault's master password; make that a long passphrase too.
If you also turn on multi-factor authentication (MFA), an attacker will find it much harder to get into your account even if your password is captured. Using passkeys wherever possible removes most of the password risk.
Frequently asked questions
How many characters should a strong password have?
There is no exact number, but longer is better. A passphrase of four or five words usually goes well past twenty characters and gives enough resistance against most attacks.
Should passwords be changed regularly?
Current guidance does not require frequent changes unless a leak is suspected. Frequent changes push people towards predictable patterns. What matters is using strong, unique passwords and MFA.
Are password managers safe?
Reputable password managers store data encrypted. As long as the master password is strong and protected with MFA, they are much safer than reusing the same password.
---
InfoLore's awareness programmes build basic habits such as password security with short, regular content. Get in touch to design a programme for your team.
Related articles
Runs the full cycle of awareness programmes, from needs analysis to impact reporting. Worked in cybersecurity channel management and consulting at Elcore Group and Digital Deals, after more than fifteen years at Turkcell and Türk Telekom. Author of "Outrun the Lion", a book on human error in cybersecurity.