Why Passwords Still Matter
Despite advances in biometrics and passkeys, passwords remain the primary authentication method for most websites and services. In 2026, over 80% of data breaches still involve compromised credentials.
What Makes a Password Strong?
Password strength is determined by entropy - the number of possible combinations an attacker must try.
Length Beats Complexity
A 16-character lowercase password has more entropy than an 8-character password with uppercase, lowercase, numbers, and symbols:
| Password | Length | Character Set | Combinations |
|---|---|---|---|
a8#Kp!2q | 8 | 95 chars | 6.6 × 10¹⁵ |
correcthorsebattery | 20 | 26 chars | 1.9 × 10²⁸ |
The longer password has trillions of times more combinations, even with a simpler character set.
The NIST Guidelines (2024 Update)
The US National Institute of Standards and Technology recommends:
- Minimum 15 characters for user-chosen passwords
- No mandatory complexity rules (uppercase, symbols) - they don't help
- No periodic password changes - forced rotation leads to weaker passwords
- Screen against known breached passwords - block passwords found in data breaches
- Allow paste - so password managers can fill credentials
Common Password Mistakes
- Reusing passwords across multiple sites (one breach compromises everything)
- Using personal information - names, birthdays, pet names are easily guessable
- Simple substitutions -
P@ssw0rdis in every attacker's dictionary - Short passwords - anything under 12 characters can be brute-forced in hours
- Sharing passwords - via text, email, or sticky notes
How Attackers Crack Passwords
Brute Force
Try every possible combination. Modern GPUs can attempt 100 billion hashes per second for MD5.
Dictionary Attack
Try common words, phrases, and known passwords from previous breaches.
Credential Stuffing
Take email/password pairs from one breach and try them on other services.
Rainbow Tables
Pre-computed hash tables that map common passwords to their hashes. Defeated by salting.
Password Manager Benefits
A password manager lets you:
- Generate unique, random passwords for every site
- Store them securely with one master password
- Auto-fill credentials without typing
- Detect when a password has been compromised in a breach
Generate Strong Passwords
Use our Secure Password Generator to create cryptographically strong passwords in-browser. Customise length, character sets, and generate in bulk.