Password Strength: What Actually Makes a Password Hard to Crack?

Most password advice is outdated. Adding an exclamation mark and a digit to 'password' doesn't make it strong — an eight-character password with a symbol still has only ~47 bits of entropy, and a modern GPU can brute-force it in hours. The real determinant of strength is entropy: the number of guesses an attacker must try.

Entropy, not complexity

Entropy measures the uncertainty of your password — how many combinations an attacker has to search. A password's entropy depends mainly on its length and the size of the character pool it draws from. Every extra character multiplies the search space; replacing a letter with a symbol barely moves the needle.

Why length beats complexity

• A 12-character lowercase password has ~56 bits of entropy — harder than an 8-character password with symbols.
• Passphrases (four random words) routinely reach 60–80 bits and are easy to remember.
• Common substitutions (P@ssw0rd) are instantly defeated by large dictionary-attack wordlists.
• Reusing a password across sites means one leak compromises everything — strength can't save you there.

Check your own passwords

Use a locale checker that scores length, variety, and common patterns — and that keeps the password on your device. The Toolverse password strength checker runs entirely in your browser, so your password never leaves your keyboard.