Password Strength: What Actually Makes a Password Hard to Crack

P@ssw0rd! looks strong. It has uppercase, lowercase, a symbol, a digit. Most signup forms would give it a green checkmark. It would also be among the first few thousand guesses in any real attack, because it’s a well-known substitution pattern applied to one of the most common words in every breach dataset ever published. Meanwhile, correcthorsebatterystaple — four random lowercase words, no symbols, no digits — would take centuries to brute-force. Complexity rules measure the wrong thing.

What “Strength” Actually Means

A password’s real strength is how many guesses an attacker needs, on average, before hitting the right one. That number is driven by two things: how large the space of possible passwords is (entropy), and whether the specific password sits in a much smaller space attackers already know to check first (patterns).

Entropy: Counting the Real Search Space

Entropy is measured in bits, and it comes from a simple idea: if a password is built from a alphabet of size N and is L characters long, the number of possible passwords is N^L, and the entropy in bits is L × log₂(N).

This is why length matters more than most people expect. Adding one more lowercase letter to a password multiplies the search space by 26. Adding one more character class (say, digits) to an already-long password barely moves the needle compared to just making it two characters longer.

A concrete comparison: an 8-character password using all four character classes (lower, upper, digit, symbol — a 95-character alphabet) has about 52 bits of entropy. A 16-character password using only lowercase letters (a 26-character alphabet) has about 75 bits — meaningfully stronger, despite “failing” a typical complexity rule that demands mixed case and symbols.

This is exactly why long passphrases (correct horse battery staple-style) are recommended by security researchers over short, complex-looking passwords: length compounds, complexity classes barely do.

Why Pattern Detection Matters More Than Raw Entropy

Entropy math assumes every character is chosen uniformly at random from the full alphabet. Real passwords are not random — people choose them, and people are predictable. Three patterns account for a disproportionate share of real-world password cracks:

Breach-list passwords. Every major password breach gets compiled into massive cracking dictionaries. password123, qwerty, letmein, iloveyou — these get tried in the first few seconds of any serious attack, regardless of what their raw entropy calculation says, because the attacker isn’t guessing randomly — they’re guessing from the list of passwords real humans actually pick.

Sequential characters. Keyboard-adjacent runs (qwerty, asdfgh) and numeric/alphabetic sequences (abc, 12345) are among the very first patterns any cracking tool checks, because they’re extremely common human shortcuts for “looks complex enough.”

Repeated characters. Strings like aaa111 or 111111 pad out the length requirement without adding real unpredictability — a password cracker checking for repeated-character patterns finds these almost immediately.

A password can score well on raw entropy and still fall into one of these traps — Passw0rd123! has decent length and hits every character class, but it’s a trivial variation on the single most-breached password in history, so attackers check it early regardless.

How Long Would It Actually Take to Crack?

Crack-time estimates depend entirely on how fast an attacker can try guesses, which varies enormously by scenario:

Throttled online guessing — trying passwords directly against a login form that has basic rate-limiting. Realistically capped around 100 guesses per second by the service itself (or far less, with proper lockout policies). At this rate, even moderate entropy holds up for a long time.

Offline fast hash cracking — this is the scenario that matters most. If an attacker steals a database of password hashes (which happens regularly in breaches) and those hashes were stored with a weak or outdated algorithm, modern GPU hardware can attempt roughly 10 billion guesses per second. At this rate, anything under about 60 bits of entropy can fall within hours to days.

This gap — 100/second vs 10 billion/second — is why the entropy target that “feels safe enough” for a login form can be catastrophically insufficient the moment a breach exposes the underlying hash database.

The Practical Takeaway

Length beats complexity rules. A long passphrase of unrelated words beats a short “complex” password every time the math is actually run. Avoid anything that shows up in breach lists, even with character substitutions (p@ssw0rd is not meaningfully different from password to an attacker’s dictionary). And the real fix for password fatigue isn’t memorizing more complex passwords — it’s using a password manager to generate and store long random ones for every account, so you never have to invent or remember a strong password yourself.

Check Your Own Password

Our free Password Strength Checker analyzes a password entirely in your browser — entropy estimate, pattern detection (breach-list, sequential, repeated characters), and crack-time estimates for both online and offline attack scenarios. Nothing you type is ever sent anywhere.

→ Open the free Password Strength Checker

Type a password, see exactly how strong it really is — no account, no upload, no tracking.