How to Build a Password That Holds Up: Length, Entropy, 2FA

A password with sixteen random lowercase letters is about 7 million times harder to guess than one with eight random characters drawn from the full keyboard, symbols and capitals included. The second one looks tougher. It isn't.

That surprises people because we've all been trained to add an uppercase letter, a digit and a symbol. The maths says something different, and it's easy to check yourself.

How to count the strength of a password

Strength comes from how many equally likely possibilities an attacker has to work through. If a password is built from N possible symbols, chosen randomly, and has length L, there are N^L possibilities. Take the base-2 logarithm of that and you get bits of entropy: L × log2(N). Each extra bit doubles the work.

Here are four candidates, all computed:

Password type	Possibilities	Entropy
8 random characters from 94 keyboard symbols	948 ≈ 6.1 × 1015	52.4 bits
4 random words from a 7,776-word list	7,7764 ≈ 3.7 × 1015	51.7 bits
16 random lowercase letters	2616 ≈ 4.4 × 1022	75.2 bits
8 random lowercase letters	268 ≈ 2.1 × 1011	37.6 bits

The 94 comes from the printable ASCII characters: 26 lowercase, 26 uppercase, 10 digits and 32 symbols. The 7,776 is 6⁵, the size of the Diceware-style lists where you roll five dice to pick each word.

So four random words and eight random keyboard characters land in the same place, about 52 bits. The sixteen lowercase letters sit 22.8 bits higher, and 2^22.8 is roughly 7.1 million. Length wins because it sits in the exponent. Adding a symbol to the alphabet only nudges the base.

From bits to guessing time, with the assumption stated

Bits are abstract. Time isn't, but it needs an assumption about the attacker. I'll use 10 billion guesses per second, which is the scenario where someone has stolen a database of fast-hashed passwords and is cracking it offline on powerful hardware. It's an assumption, not a measurement. Sites that store passwords with slow, deliberately expensive hashing (bcrypt, scrypt, Argon2) force the real rate down by orders of magnitude, and a site that stores them badly can make it far worse for you. Change the rate and every figure below scales in proportion.

On average an attacker finds the password after trying half the possibilities, so average time = possibilities ÷ 2 ÷ rate.

Password	Average time at 10 billion guesses/sec
8 random lowercase letters	about 10 seconds
8 random keyboard characters	about 3.5 days
4 random words	about 2.1 days
5 random words (64.6 bits)	about 45 years
16 random lowercase letters	about 69,000 years
6 random words (77.5 bits)	about 350,000 years

Read that first row twice. Eight lowercase letters, the kind of thing many people think is fine, falls in seconds under this model. And a "complex" eight-character password falls in days. Neither is safe from offline cracking. Both are fine against someone typing guesses into a login page, because a site that locks you out after a few attempts caps the rate at a tiny number. That's why a short password isn't instantly doomed everywhere, and why it still shouldn't protect anything you care about.

The catch: all of this assumes true randomness

The table is for passwords picked by a random process: dice, a generator, a coin. It does not apply to passwords picked by a human, even a clever one.

When people build "Priya@1998!" they don't draw from 94 symbols at random. They start with a name, capitalise the first letter, add a year and finish with the one symbol everyone uses. Attackers know this and guess in exactly that order. A password like this has far less real entropy than its length suggests, nowhere near 52 bits. Likewise, "correcthorsebatterystaple" is a fine idea turned bad the moment it's printed in a famous webcomic and ends up in a cracking wordlist. Words only count as random when the computer picked them.

This is why the password generator exists. It uses the browser's cryptographic random source, so what comes out has the entropy the table promises. You don't have to trust your own taste in randomness, because humans are bad at it.

Passphrases: when you must remember it

You'll need a handful of passwords that can't live in a manager: the manager's own master password, your laptop login, maybe your phone. For those, use a passphrase. Pick five or six words using dice or a generator, not your favourite song lyric. Five words gives about 64.6 bits, six gives 77.5. Separate them with a space or hyphen so you can type them, and say them out loud a few times. Within a week they live in your fingers.

I'd go with six for the master password. The cost is a few extra seconds of typing, and the gain is the jump from decades to hundreds of thousands of years under the assumption above.

Why length beats complexity rules

NIST's guidance on digital identity (SP 800-63B) says the same thing in policy language. It leans toward length over forced composition rules, says sites should allow long passwords, and advises against making people change passwords on a schedule. Forced rotation produces "Summer2026!" followed by "Autumn2026!". The scheme is predictable, and predictable is the opposite of random.

If a site makes you add a symbol, fine, add one. But the length is doing the work.

A password manager, and what to do about its weak spot

Nobody can remember sixty unique random passwords. A password manager can. Let it generate a long random password for every account, and you remember one master passphrase. Use a different one for each site and a breach of one account stays inside that account, which matters more than any entropy figure. The next article, why strong passwords still get hacked, covers why.

The manager has one real weak spot: the master password and your recovery arrangement. Make the master passphrase long and random, keep it nowhere digital, and write the recovery key on paper stored with your important documents. A good manager can't reset your master password for you, by design, so a lost one means lost data.

A browser's built-in manager is better than reusing passwords. A dedicated one is better again, mainly because it works across browsers and phones. I wouldn't spend time arguing over which brand. Pick one with a good reputation and start.

Two-factor authentication, ranked

A second factor protects you when the password leaks anyway. Not all second factors are equal.

1. Passkeys and hardware security keys. They can't be typed into a fake site, so phishing doesn't work on them. Use these wherever offered.
2. Authenticator app codes. Time-based codes generated on your phone. Much better than SMS.
3. SMS codes. Better than nothing. They can be intercepted through SIM swapping or talked out of you by a scammer. Still, turn it on if it's all that's available.

Turn on 2FA for email first. Your email is the reset route for everything else, so whoever owns it owns the rest.

A short order of work

Start with your email and banking accounts. Set a six-word passphrase for the manager, move those accounts to unique generated passwords, and add an authenticator app or passkey. Then do the rest as you log into them. You don't need a weekend. You need the next ten sign-ins.