What makes a password strong from a hacker’s perspective?
Originally published August 2024 · Updated November 2026.
Password strength comes down to two questions. If we are guessing our way into a system, how easy is the password to guess? If we uncover a hashed version of the password, how easy is it to crack?
Answering both means understanding password entropy, a measure of how predictable a password is. The bottom line with entropy is that length matters most.
Why does length matter more than complexity?
The number of attempts an attacker needs to guess a password is a good measure of its strength, because guessing is what attackers do in the real world. In principle, the higher a password’s entropy, the better it resists brute force attacks. Each added character multiplies the number of possible passwords, so the number of combinations grows exponentially with length.
Two examples:
A 14-character password using only lowercase Latin letters has an entropy of 65.8 bits.
A 6-character password with three lowercase letters, one uppercase letter, one digit, and one special character has an entropy of 39.33 bits, which is significantly less.
Why are three words better than random characters?
More words make a longer password, which makes the stored hash much harder to crack and the password much harder to guess or brute force. A short password of six random characters can still be cracked or guessed quickly. A 14-character password built from three words is significantly harder, because the number of combinations grows exponentially with length. Modern cracking tools would need far longer, and a successful guess becomes much less likely.
Which words should you use or avoid?
Avoid anything that simply strings together three common dictionary words, because password cracking programs are built to append common words to each other. Also avoid words clearly tied to you. If you have a Facebook page or other social media, a determined attacker may feed your personal details, such as a pet’s name, into their cracking tools.
What is the best way to create a password?
Do not create a password at all. Create a passphrase.
Think of a moment that means a lot to you but is not obvious to anyone else. Then take three to five words and string together a phrase that reminds you of it. For example, “wintertriptovirginislands” is much easier to remember than “t5$j2$o2/” because you connect it to a good time in your life, and its entropy is much higher because of its length.
What does current guidance say about passwords?
NIST’s Digital Identity Guidelines (SP 800-63B, Revision 4, published in 2025) point the same direction as this article:
- Length: at least 15 characters when a password is the only authenticator (8 when it is one part of multi-factor authentication), and systems must accept at least 64 characters.
- No composition rules: organizations should not require mixes of character types.
- No routine rotation: passwords should be changed when there is evidence of compromise, not on a schedule.
- Blocklist screening: new passwords should be checked against lists of common and breached passwords.
Pair a long passphrase with multi-factor authentication. See A Hacker’s Perspective: Top Three Ways to Mitigate Modern Phishing Techniques for how attackers get around weak MFA.
Want to know how your organization’s credentials hold up? Talk to Echelon about penetration testing and security awareness training.
FAQs
How long should a password be?
Longer is better. NIST’s current guidance sets a minimum of 15 characters when a password is the only authenticator and requires systems to accept at least 64. A passphrase of several words makes it easy to reach that length and still remember it.
What is password entropy?
Password entropy measures how predictable a password is. The higher the entropy, the more guesses an attacker needs. For example, a 14-character lowercase password has an entropy of 65.8 bits, while a 6-character password mixing letters, a digit, and a symbol has 39.33 bits.
Is a passphrase better than a password?
In most cases, yes. A passphrase of three to five words is much longer than a typical password, and length is the biggest factor in resisting guessing and cracking. It is also easier to remember than a short string of random characters.
Should I change my password regularly?
Not on a fixed schedule. NIST’s current guidance advises against routine password changes and says to change a password when there is evidence it has been compromised. A long, unique passphrase does more for you than frequent changes.
Do I still need multi-factor authentication with a strong password?
Yes. A strong password makes guessing and cracking harder, but multi-factor authentication adds a second barrier if a password is stolen or reused. Prefer phishing-resistant methods where they are available.