Password length beats complexity

Short answer: length wins, and it is not close. Each extra character multiplies the number of guesses an attacker has to make, while forcing in a symbol or a capital adds only a small fixed amount. Four ordinary words chosen at random beat eight characters of punctuation — and reusing a password defeats either one.

For most of the last two decades the advice was to add a capital, a number and a symbol. The arithmetic behind that advice says something different, and the gap is large enough to be worth a few minutes.

What actually determines strength

The only thing that matters is how many guesses an attacker has to make. That is the size of the space your password was drawn from — the number of possible strings that look exactly like yours to someone who does not know it.

guesses = (size of the character set) ^ (number of characters)

Security people measure this in bits: the base-2 logarithm of that number. Every extra bit doubles the work. The formula makes one thing obvious immediately — the exponent is the length, and the base is the alphabet. Growing the exponent has a very different effect from growing the base.

Two ways to spend the same effort

Take a password with 16 characters drawn from letters only — 52 possibilities per character, if you use both cases.

52^16 ≈ 2.9 × 10^27  ≈ 91.0 bits

Now take an 8-character password using letters, digits and symbols — a 94-character alphabet, which is close to everything on a keyboard.

94^8 ≈ 6.1 × 10^15  ≈ 52.5 bits

The 16-letter password is about four hundred billion times harder to brute-force, and the 8-character one is the "complex" one. Eight characters is simply not a long enough exponent, no matter how varied the alphabet is.

Read a row and a column against each other. Adding four characters to an 8-character letters-only password gains about 19 bits. Adding the whole keyboard to that same 8-character password gains about 15. Length wins, and it keeps winning as you go.

The context that changes the answer

Raw entropy is only half the picture, and ignoring the other half is how people end up with P@ssw0rd1!.

If the attacker guesses intelligently

Real attacks are not exhaustive search. They try known leaked passwords first, then dictionary words, then words with predictable modifications — capitalise the first letter, append a digit, append !. A password like Summer2026! satisfies every complexity rule and is cracked almost immediately, because it is one dictionary word plus two of the most common suffixes in the list.

That is the failure of complexity rules: they describe the shape of the string without saying anything about its predictability. People respond to rules by making the smallest change that satisfies them, and the resulting shapes are exactly what the cracking dictionaries are built around.

What this means for length

A long password built from unrelated words has far more real entropy than its character count suggests, because the attacker cannot treat the words as independent characters. Four random words chosen from a list of a few thousand have roughly 44 bits on their own. Six words push past 65. Sentence-shaped passwords such as correct-horse-battery-staple are strong not because they are long, but because the words were chosen at random rather than by a human reaching for a memorable phrase.

Which is the catch: randomness, not memorability, is doing the work. A passphrase you invented is probably not random — it reflects something about you, and that narrows the space considerably.

So what should you actually do

1. Use a password manager. It removes the memory constraint entirely, which is the only reason short passwords ever seemed reasonable. Then every password can be 20 random characters.
2. Let it generate, not you. Human-chosen passwords are systematically weaker than random ones of the same length, because humans cluster. The generator here draws from the browser's cryptographic random source — the same primitive used for encryption keys, not a clock-seeded pseudo-random function.
3. Length first, then variety. If something forces you to memorise a password, prefer a longer one over a more complicated one. Twenty letters-only characters beat twelve mixed ones.
4. Never reuse. See below — this is the one that actually gets people.

The part that outweighs the arithmetic

Every figure above assumes the attacker has to break your password. In practice, breaches of consumer services overwhelmingly do not work that way. They work because a password used on one badly-secured site was reused on another, and the first site leaked it in plaintext or with weak hashing. The attacker does not crack anything. They log in.

Against that attack, entropy is irrelevant. A 128-bit password reused on a compromised forum is compromised. A mediocre unique password on a well-run site is not.

Uniqueness beats length. Length beats complexity. Complexity, on its own, is mostly theatre.

What good sites do with your password

This is outside your control, but it is worth knowing what to look for, because it determines how much damage a leak causes.

• Hashing with a slow, salted algorithm — bcrypt, scrypt or Argon2. A plain SHA-256 hash is fast to compute, which is exactly the wrong property: a GPU can try billions per second. Salting prevents precomputed lookup tables and stops identical passwords producing identical hashes.
• Rate limiting on login attempts. Without it, even a strong hash can be attacked online.
• Two-factor authentication. It does not make your password stronger; it makes a stolen password insufficient on its own, which is a better property.

A practical default

Sixteen random characters from the full set is around 100 bits, which is beyond anything brute-forceable with foreseeable hardware. Twenty is comfortable. Anything above that buys nothing a person will ever notice.

Generate it locally, store it in a manager, and use a different one everywhere. That combination is worth considerably more than any amount of deliberate complexity, and it takes less effort than remembering a single awkward password.