Why your complex password is likely weaker than a simple, long, random passphrase.
In short: Password strength relies on entropy, a measure of unpredictability. While systems demand complex characters, human habits make these patterns predictable to attackers. Ironically, forcing users to create complex, hard-to-remember passwords often leads to weaker security, as people resort to predictable substitutions or writing them down in insecure locations.
Password strength is fundamentally a measure of resistance against guessing or brute-force attacks, quantified by information entropy. Entropy represents the minimum number of bits needed to hold a password's information, effectively acting as a base-2 logarithm of the total possible guesses. Increasing entropy by just one bit doubles the number of attempts an attacker must make to exhaust all possibilities. While random passwords generated by modern operating systems can achieve high entropy, humans are notoriously poor at generating it. Studies show that human-selected passwords often fall into predictable patterns, such as using common words or simple modifications like adding a number to the end.
The industry has shifted its approach to these limitations. Older guidelines, such as the NIST Special Publication 800-63-2 from June 2004, attempted to estimate entropy for human-selected passwords but were later found to be invalid as more real-world data became available. Consequently, the June 2017 revision of the publication abandoned that approach. Modern recommendations from both US and UK cybersecurity departments now prioritize length and memorability over short, complex strings. As of 2026, NIST recommends a minimum length of 15 characters, as longer passwords significantly increase the work factor for an attacker.
Technical implementation is just as critical as password choice. Storing passwords in plaintext or using simple cryptographic hashes is dangerous, as these can be cracked rapidly using modern hardware like high-end graphics processors. For instance, by 2011, commercial tools could test 112,000 passwords per second on a standard desktop. To mitigate this, administrators should use key stretching—a process that makes computing hashes computationally expensive—and add a random value called a salt to prevent the use of pre-computed rainbow tables. Ultimately, security experts like Bruce Schneier argue that because computing power grows over time, the required entropy must also increase, making long, unique passphrases the most robust defense against evolving brute-force capabilities.
Opens the Intellect+ feed with this card first. Swipe up for the next one.
Sources
- Summary by Intellect · source: Password strength
To cite this card, link to https://intellectplus.co.uk/app/science-password-strength.
How we source, check and correct cards: Editorial standards.
General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.
Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?
Related
More in Mathematicians · More in Science · Latest · A–Z · All topics
