What Makes a Password Strong in 2026: Entropy Explained Simply

Password advice has been wrong for decades. The standard guidance. use uppercase, lowercase, numbers, and symbols. produces passwords like P@ssw0rd1 that are both hard to remember and easy to crack. The actual metric that matters is entropy, and length is its most powerful driver. In 2026, NIST's own guidance has shifted firmly toward length and away from arbitrary complexity rules. a change that most websites have not yet caught up with.

What Is Password Entropy?

Entropy measures how unpredictable a password is, expressed in bits. A password with 40 bits of entropy has 2⁴⁰ (about 1 trillion) possible values. Each additional bit doubles the search space. At 60 bits, you're at 1 quadrillion possibilities. and doubling continues from there.

A 16-character lowercase password has more entropy than an 8-character password using every character type. Length wins, and it wins by a significant margin.

The critical caveat: this formula assumes the password is generated randomly. Human-chosen passwords have dramatically lower effective entropy because we are predictable. We use dictionary words, names, dates, and recognisable substitutions. A human-chosen 16-character password that follows a pattern may have an effective entropy closer to 20–30 bits, not 75. The formula only holds when the choices are genuinely random.

Source: NIST SP 800-63B. Digital Identity Guidelines

How Long Does Cracking Actually Take?

A modern GPU cluster can test about 100 billion password guesses per second against an unsalted MD5 hash. Against a properly salted bcrypt hash (what good services use), that drops to around 100,000 per second. The hashing algorithm the target service uses is therefore as important as your password strength.

The jump from 8 to 12 characters. even without adding special characters. moves your password from "crackable in an afternoon" to "effectively uncrackable in any realistic timeframe." Good bcrypt hashing already makes 8-character passwords slow to crack, but that protection only holds until hashing hardware improves. Length provides durable protection that does not depend on the server's implementation choices.

The Problem With Complexity Requirements

Forced complexity makes passwords more predictable, not less. When required to add a number, most people add it at the end. When required to add a symbol, most people use ! or @. Attackers know these patterns and include them in their dictionaries. The result is that complexity requirements produce a false sense of security.

NIST's updated SP 800-63B guidelines explicitly recommend against mandatory complexity rules, against mandatory periodic resets (which cause people to make predictable incremental changes like Password1! → Password2!), and against security questions. All three increase user burden without meaningfully improving security.

A truly random 12-character password is far stronger than a human-chosen 12-character password that meets complexity requirements. The randomness is what matters, not the character types.

Passphrases: Long and Memorable

A passphrase like correct-horse-battery-staple (from the famous xkcd comic) has about 44 bits of entropy if chosen from a 2,000-word dictionary, and much more if the words are truly random. It's easy to remember and long enough to be practical.

Four random words from a large dictionary easily exceeds 50 bits. Six words exceeds 75 bits. equivalent to a fully random 13-character password using all character types.

Passphrases are ideal for your password manager master password, device login, and the handful of accounts where you must type a password from memory. For everything else, a password manager generating random strings is the better option. you gain more entropy per character than any human-memorable scheme can provide.

Password Reuse: The Bigger Risk

The most common way accounts get compromised in 2026 is not cracking. it is credential stuffing. Attackers take username/password pairs leaked from one breach and automatically try them across hundreds of other services. If you use the same password on your email and your bank, a breach at a low-security forum hands attackers the keys to both.

Over 8 billion credential pairs are publicly available in breach databases. Tools like Have I Been Pwned let you check whether your email address appears in known breaches. If it does, any reused password associated with that email must be considered compromised regardless of its strength.

Unique passwords are non-negotiable. The practical way to have unique passwords everywhere is a password manager. You remember one strong master password; it remembers everything else and generates random credentials for each site.

Practical Rules for 2026

• Minimum 12 characters for any account. 16+ for anything important. 6+ random words for anything you must memorise.
• Use a password manager. Bitwarden (open source, free), 1Password, and Dashlane are all reputable options. You only need to remember one strong master passphrase.
• Never reuse passwords. A breach at one site should not affect others. The password manager handles this automatically.
• Enable 2FA wherever available. A time-based authenticator app (TOTP) is stronger than SMS. Even a weak password with TOTP 2FA is significantly harder to exploit than a strong password without it.
• Random beats memorable. Let your password manager generate and store truly random passwords. Reserve memorable passphrases for master passwords and device logins only.
• Check for breaches. Run your email through haveibeenpwned.com periodically. Change passwords for any site that appears in a breach, even if the password was strong.

Check how your current passwords score. and generate new ones. using the tools below.