HomeAll 48 Tools
Case ConversionUppercase to LowercaseTitle CaseSentence CasecamelCasesnake_casekebab-case
Text ToolsWord CounterCharacter CounterText CompareRemove Line BreaksSort LinesLorem Ipsum Generator
Developer ToolsBase64 Encode / DecodeJSON FormatterURL Encode / DecodeUUID GeneratorPassword GeneratorSHA Hash Generator
BlogAboutContactFAQsPrivacy Policy
Guide

Strong Passwords: Length Beats Complexity

·7 min read

P@ssw0rd! looks strong. It has uppercase, lowercase, a number, a symbol, and it satisfies almost every password form on the internet.

It is also one of the first passwords any cracking tool tries. Meanwhile correcthorsebatterystaple — plain lowercase letters, no symbols, no numbers — is vastly harder to break.

Understanding why changes how you pick passwords.

How cracking actually works

Attackers do not sit at a login form typing guesses. They steal a database of password hashes and attack it offline, at enormous speed, with no rate limiting.

They also do not start from aaaa. They start with:

  1. Leaked password lists. Billions of real passwords from previous breaches. If yours appears in any of them, it is cracked instantly.
  2. Dictionary attacks with mangling rules. Every dictionary word, plus every predictable variation — capitalise the first letter, add a number, add an exclamation mark, swap a for @, o for 0, e for 3.
  3. Brute force. Only as a last resort, for passwords that resist everything above.

Step 2 is why P@ssw0rd! fails. Every substitution you think is clever is a standard rule in every cracking toolkit. The transformation adds essentially no work for the attacker.

The maths of length

Password strength is measured in entropy — bits of genuine randomness. Each extra character multiplies the search space:

PasswordCharacter setCombinations
8 chars, all types~95~6.6 × 1015
12 chars, lowercase only26~9.5 × 1016
16 chars, lowercase only26~4.4 × 1022
20 chars, all types~95~3.6 × 1039

Note the second row: 12 lowercase characters beats 8 mixed characters, despite using a quarter of the alphabet. Length compounds exponentially; adding symbols only widens the base.

The critical caveat: this only holds if the password is random. passwordpassword is 16 characters and worthless, because it is two dictionary words and appears in every wordlist. Length without randomness buys you nothing.

What actually matters, in order

  1. Uniqueness. A perfect password reused across sites is only as safe as the weakest site holding it. Credential stuffing — trying leaked email and password pairs on other services — is the single most common way accounts are taken over.
  2. Length. 16 characters minimum for anything that matters. 20+ for email and banking.
  3. Randomness. Generated, not invented. Humans are terrible random number generators and reach for the same patterns.
  4. Character variety. Genuinely last. It helps, but far less than the three above.

Note that email sits at the top of the priority list alongside banking. Your email account can reset the password on nearly everything else you own — it is the master key, and it deserves your strongest password and two-factor authentication.

Use a password manager

Every rule above collapses without one. Nobody remembers forty unique 20-character random strings, so people reuse passwords instead — which is the worst possible outcome.

A password manager generates, stores, and fills them. You memorise exactly one strong passphrase. This is the highest-impact security change most people can make, and it takes an afternoon.

Generate the passwords themselves with a cryptographically secure source. Our password generator uses crypto.getRandomValues() rather than Math.random(), which is predictable and unsuitable for secrets. Nothing is transmitted or stored — you can confirm that in your browser's network tab.

Stop rotating passwords on a schedule

The old advice to change every 90 days has been formally reversed. Both NIST in the US and the NCSC in the UK now advise against routine expiry.

The reasoning is behavioural: forced rotation makes people pick weaker passwords with predictable increments — Summer2025! becomes Summer2026! — and write them down. The policy made things worse, not better.

Change a password when there is a reason: evidence of compromise, a breach notification from the service, or you suspect it was shared or shoulder-surfed. Otherwise leave a strong unique password alone.

Turn on two-factor authentication

2FA is the strongest single improvement after uniqueness, because it means a stolen password alone is not enough to get in.

  • Hardware keys or passkeys — strongest, and resistant to phishing.
  • Authenticator apps — very good, and free.
  • SMS codes — weakest, because SIM swapping is a real attack. Still far better than nothing.

Passphrases, if you must memorise one

For the few passwords you genuinely have to remember — your password manager's master password, your device login — use a passphrase of four or five random words. Not a quotation, not song lyrics, not a phrase you like. Random, ideally chosen by dice or a generator.

They are long, memorable, and easy to type on a phone keyboard. The famous correcthorsebatterystaple example works precisely because those four words have no relationship to each other.

Checklist

  • Unique password for every account, without exception
  • 16+ characters, 20+ for email and finances
  • Generated randomly, not invented
  • Stored in a password manager
  • Two-factor authentication wherever offered
  • Changed on evidence of compromise, not on a calendar
  • Check your email address on a breach notification service

Try the tool

Convert text between 14 case formats instantly — free, no sign-up, and everything stays in your browser. Open the converter →

More guides

How Many Words Is a 5 Minute Speech?A 5 minute speech runs to roughly 650 words. Here is the full table for every common talk length, why the number is lower than people expect, and how to time yours properly.How Many Pages Is 1,000 Words?1,000 words is roughly 2 pages double spaced or 4 single spaced — but font, margins, and spacing move that number a lot. Here is the full table and what actually changes it.Character Limits for Every Social PlatformEvery platform has two limits: the hard cap, and the much shorter point where your text gets cut off with a "more" link. The second one is the one that matters.Title Capitalization: AP vs Chicago vs APAFour style guides, four sets of rules, and one question: does "over" get a capital? Here is what each guide actually says and how to stop arguing about it.Readability Scores Explained (and Their Limits)Readability formulas measure two things: sentence length and syllable count. That makes them genuinely useful and easy to game. Here is how to read the score honestly.How to Write URL Slugs That RankURLs are a small ranking factor but a large usability one. Here are the rules worth following, and the one mistake that genuinely costs you traffic.Encoding vs Encryption vs HashingBase64 is not encryption. Hashing is not encryption. Confusing these three is behind a surprising number of real security incidents — here is the distinction.10 Common JSON Errors and How to Fix ThemAlmost every JSON parse failure comes down to one of ten mistakes. Here they are, with the reason each is invalid and the fix.Regex Cheat Sheet for BeginnersEverything you need to read and write ordinary regular expressions, in one page — plus the greedy matching trap that catches everybody.How to Fix Text You Accidentally Typed in All CapsYou wrote three paragraphs before noticing caps lock was on. Do not retype them — here are four ways to fix it in a couple of seconds.camelCase, snake_case, kebab-case: A Naming GuideFive naming conventions, and the rules for which one to reach for. Most of the choice is decided by your language — the rest is decided by what the name is.Title Case vs Sentence Case: Which Should You Use?Title case looks authoritative. Sentence case reads faster. Here is how to decide which one your headings should use — and the rules for getting each one right.