Password security advice sounds the same everywhere: use at least eight characters, mix uppercase and lowercase, add a number, throw in a symbol. It has been repeated so often that it feels like settled science.
It isn’t.
Much of that advice was written for a threat that barely exists anymore, while the threats that actually compromise accounts today are rarely mentioned at all. Understanding how passwords are actually broken changes almost everything about what real password security requires — and why some of the “strong” passwords people are proud of are weaker than they think.
This article explains what actually happens when an attacker tries to break into an account, why traditional complexity rules miss the point, and what genuinely improves password security in practice.
How Passwords Are Actually Stolen
Before talking about what makes a password strong, it helps to understand how passwords are compromised in the first place — this is the foundation real password security is built on. Complexity rules only matter for one specific attack method — and that method is no longer the most common one.
Method 1: Guessing the Password Directly
This is the scenario most advice is built around: an attacker sits at a login screen and tries password after password until one works.
In reality, this almost never happens anymore. Most login systems lock an account or add delays after a handful of failed attempts, which makes direct guessing painfully slow and easy to detect. A well-configured service will stop this kind of attack long before complexity matters.
Method 2: Cracking a Stolen Password Database
This is where complexity rules genuinely apply — but not in the way most people assume.
When a company is breached, attackers rarely walk away with plain-text passwords. Properly built systems store a hash of the password instead: a one-way mathematical transformation that turns “Sunshine2024!” into something like a94a8fe5ccb19..., a string that cannot be reversed back into the original password.
To recover the original, attackers don’t reverse the hash — they guess passwords, hash each guess, and check whether it matches. This is where computing power matters. A modern GPU can compute billions of hashes per second against weak hashing algorithms (though well-designed systems using algorithms like bcrypt or Argon2 slow this down deliberately, sometimes to a few thousand guesses per second).
This is also where salting matters¨.A salt is random data added before hashing, so that two people who happen to choose the exact same one — say, “Password123!” — end up with completely different hashes.”end up with completely different hashes. Without salting, attackers can pre-compute massive tables of common password hashes (called rainbow tables) and look up matches instantly. With salting, that shortcut disappears. For a technical breakdown of how these algorithms compare, the OWASP Password Storage Cheat Sheet is a solid reference maintained by security practitioners.
The practical takeaway: if a service you use properly salts and hashes passwords with a modern algorithm, brute-forcing your specific password is often impractical even if it’s only moderately complex — attackers usually aren’t cracking one password at a time. They’re cracking the weakest passwords in a stolen database of millions, because that’s a far better use of computing time than targeting one strong password.
Method 3: Credential Stuffing
This is the method most account compromises actually rely on today, and it has nothing to do with password complexity.
When a service is breached and passwords leak — hashed or not — attackers compile those email-and-password combinations into massive lists. They then try those exact combinations against other services: banking sites, email providers, shopping accounts, social media.
If you reused “Sunshine2024!” across five accounts and any one of those five services gets breached, all five accounts are now exposed — regardless of how “strong” that password looked on paper. This is why password reuse, not password complexity, is the single biggest driver of real-world account compromise.
Method 4: Phishing
No password strength helps here. If an attacker convinces you to type your password into a fake login page, they get it directly, whether it’s “123456” or a 40-character random string. Strength and phishing resistance are unrelated problems.
Why Traditional Complexity Rules Miss the Point
Knowing these four methods, the classic advice — eight characters, one uppercase letter, one number, one symbol — starts to look outdated.
It was designed almost entirely around Method 1 and an early version of Method 2, back when hashing was often weak or absent altogether and direct guessing was more feasible. It does almost nothing to protect against credential stuffing or phishing, which are the two methods responsible for most real-world breaches today — and, as a result, the two methods that modern password security advice should actually center on.
Worse, forced complexity rules often push people toward predictable complexity: capitalizing the first letter, adding “!” at the end, substituting “3” for “e”. Attackers know these patterns well, and modern cracking tools test them automatically. A password like “P@ssw0rd1!” technically satisfies every complexity rule and is still one of the first guesses a cracking tool will try.
What Actually Makes a Password Strong
Good password security ultimately comes down to a measurable property. Security researchers generally measure password strength using a concept called entropy — a measure of how unpredictable a password is, expressed in bits. Higher entropy means more possible combinations an attacker would have to try before finding the right one.
Two factors drive entropy far more than symbol requirements do:
Length. Every additional character multiplies the number of possible combinations. A 16-character password built from lowercase letters alone has more possible combinations than an 8-character password using the full range of uppercase, lowercase, numbers, and symbols.
Unpredictability. A password needs to be hard to guess specifically because you chose it, not just because it looks complicated. “Tr0ub4dor&3” looks complex but follows predictable substitution patterns attackers already account for.
Passphrases vs. Random Strings
This is where the classic “use a random string of characters” advice runs into a real-world problem: humans are bad at remembering random strings, so they write them down, reuse them, or simplify them — quietly undoing the security benefit.
A passphrase — several unrelated words strung together, like “correct horse battery staple” — solves this differently. Four random common words chosen from a large dictionary can produce entropy comparable to, or higher than, a shorter complex password security, while being dramatically easier for a human to remember and type correctly.
The important word here is random. “iloveyoubaby” is a phrase, but it’s a predictable one — it appears in cracking dictionaries built from common phrases, song lyrics, and leaked password lists. A strong passphrase should combine words that have no logical relationship to each other and ideally aren’t a quote, lyric, or common expression.
For most people, though, the real answer isn’t choosing between passphrases and random strings by hand at all — it’s letting a password manager generate and store either one, so memorability stops being a constraint entirely.
The Real Priority Order for Password Security
Given everything above, here is what actually reduces risk, roughly in order of impact:
- Never reuse passwords across accounts. This alone eliminates the risk from credential stuffing, the most common real-world compromise method.
- Use a password manager. It removes the need to memorize anything, which makes both uniqueness and length practical at the same time — see our breakdown of how password managers actually protect your data, based on security audits for how this holds up under real scrutiny.
- Enable multifactor authentication wherever it’s offered, especially on email, banking, and any account with password-reset access to others. MFA stops most attacks even when a password is compromised — though not every method offers the same protection, as explained in our guide on what two-factor authentication actually blocks and where it fails.
- Prioritize length over symbol-stuffing. A long passphrase beats a short “complex” password in almost every realistic attack scenario.
- Be suspicious of unexpected login requests, since no password strength protects against phishing.
Notice that complexity — the thing most advice obsesses over — sits near the bottom of this list, not the top.
A Practical Example
Consider two passwords:
Tr0ub4dor&3— 11 characters, uses uppercase, lowercase, a number, and a symbol. Satisfies almost every corporate complexity policy.horse-lantern-copper-window— 28 characters, all lowercase, no numbers or symbols, four unrelated words separated by hyphens.
Against a modern offline cracking attempt on a properly salted, slow-hashed database, the second password is dramatically harder to break, despite failing most traditional complexity checklists. It’s also easier to type correctly and remember, if it needs to be remembered at all.
This is the gap between advice built on outdated assumptions and advice built on how attacks actually work — and it’s exactly the kind of nuance that separates real password security from a checklist illusion of it.
What This Means If You Reuse Passwords Today
If reading this made you realize you’ve reused a password somewhere, the practical fix isn’t panic — it’s prioritization. Improving your password security doesn’t require fixing every account at once. Start with the accounts that matter most: your primary email (because it can reset passwords for almost everything else), your banking and financial accounts, and any account tied to your identity or payment information. Change those first, ideally to unique passwords generated and stored by a password manager, and enable MFA on each one while you’re there. Work outward to less critical accounts as time allows.
Frequently Asked Questions
Is a longer password always more secure than a complex one?
Generally, yes, when comparing realistic options. Length has a bigger mathematical impact on the number of possible combinations than adding symbols to a short password security. A long, unpredictable passphrase typically outperforms a short password stuffed with special characters.
Do I still need symbols and numbers in my password?
Not necessarily, if the password is long and unpredictable. Many security-focused organizations, including NIST, have moved away from recommending mandatory complexity rules in favor of length and screening against known breached passwords — a shift that reflects how password security is actually assessed by professionals today.
How often should I change my passwords?
Frequent, mandatory password changes are no longer widely recommended, because they tend to push people toward small, predictable variations of the same password security. It’s more effective to use a unique, strong password per account and change it only when there’s a specific reason to believe it was exposed.
Are password managers actually safe to use?
Reputable password managers use strong encryption and, in most cases, a zero-knowledge architecture, meaning even the provider cannot read your stored passwords. The risk of reusing weak passwords across multiple accounts is generally far higher than the risk of using a well-reviewed password manager.
What is credential stuffing, exactly?
Credential stuffing is when attackers take email-and-password security combinations leaked from one breached service and automatically try them on other websites, hoping people reused the same password. It’s effective purely because of password reuse, not because any individual password was weak — which is why avoiding reuse is the single highest-impact habit in real-world password security.
Can a strong password protect me from phishing?
No. Phishing tricks you into typing your password security into a fake page controlled by the attacker, who then has the real password regardless of how strong it was. Password strength and phishing resistance are separate problems that require separate defenses, such as verifying links before clicking and using multifactor authentication.
Final Thoughts
The advice to “make your password complex” was never wrong, exactly — it was aimed at a threat model that has largely been replaced by more effective attack methods. Modern hashing has made brute-force cracking of individual passwords far less practical, while password reuse and phishing have become the dominant ways accounts actually get compromised. Real password security today has to account for that shift.
That shift matters because it changes where your effort should go. A single long, unique passphrase per account, generated and stored by a password manager, protects against credential stuffing far more effectively than a short password with a forced symbol at the end. Multifactor authentication closes the gap that no password, however strong, can close on its own.
Security habits that match how attacks actually happen will always outperform habits that just look secure. Real password security is only one piece of that picture — and, on its own, rarely the most important one.