The coloured bar under a password box is checking the wrong thing. Most of them just look for a capital, a number and a symbol. Tick those boxes and the bar turns green.
That is why P@ssw0rd1 scores well on many websites. It is also one of the first things any attacker tries.
What really decides whether a password survives is how many other passwords it could have been. A bigger pool means more guessing. That is the only thing that counts.
The rules make passwords that look hard to people and easy to computers.
What the numbers look like
The times below assume a hundred billion guesses a second. That is a serious attacker with good hardware, and far more than any website login would ever allow. We use a harsh figure on purpose.
| Password | Strength | Time to crack |
|---|---|---|
| 8 characters, mixed | 49 bits | 48 minutes |
| 12 letters, all lowercase | 56 bits | about 4 days |
| 6 random words plus 2 digits | 67 bits | about 18 years |
| 20 characters, mixed | 123 bits | longer than the universe has existed |
Look at the first row. Those eight characters include a capital, a number and a symbol. They pass every rule any signup form has ever asked for.
Length beats complexity, and it is not close
Add one character to a random password and you multiply the attacker's work by about seventy. Add a symbol to a short password and you barely move the number.
The advice to make passwords complicated made sense when they were short. It became harmful when it pushed people towards short passwords they could remember instead of long ones.
That is why the third row works so well. Six ordinary words are far easier to type on a phone than twenty random characters. They are also stronger than any eight-character password can be.
The words being ordinary is not a weakness. The strength comes from how many combinations exist. A rare word you cannot remember defeats the whole point of using words.
Rules that make things worse
- Forcing a change every ninety days. People just add a number on the end, and so can an attacker.
- A maximum length. There is no good reason for one, and a low limit often hints the password is being stored badly.
- Banning spaces or certain symbols. It shrinks the pool and rules out word-based passwords.
- Security questions. They ask for facts about you that are often public and can never be changed.
What to do instead
Use a password manager. Let it make long random passwords you never have to see. Protect the manager itself with a phrase of six words or more.
Turn on two-step login wherever it is offered. It covers the case a strong password does not: the website itself being broken into and your password taken rather than guessed.
And stop using the same password on more than one site. Reuse turns one company's breach into a problem with your email. No amount of complexity helps there, because the password was never guessed in the first place.