Your Password Is Probably Terrible — Here's Why It Matters

How Passwords Actually Get Cracked

Most people imagine a hacker sitting at a keyboard typing guesses. That's not how it works. Password cracking is almost entirely automated, and modern tools are terrifyingly fast.

When a website gets breached, attackers get a database of hashed passwords — not the passwords themselves, but a scrambled version. They then run billions of guesses per second through the same hashing algorithm until a match is found. On a modern GPU, this can be 100 billion guesses per second for weaker hash types like MD5.

Three main attack methods

• Dictionary attack: Try every word from a list of known passwords and common words. The list "rockyou2024" contains over 10 billion leaked passwords. If your password was ever in a breach, it's in these lists.
• Rule-based attack: Take dictionary words and apply transformations — capitalize the first letter, add a number, replace e with 3, etc. "P@ssw0rd1!" is on every rule list. If you think you're being clever, you probably aren't.
• Brute force: Try every possible combination of characters up to a given length. For 8-character passwords with common characters, this is fast. For 16+ character random passwords, it's computationally infeasible.

Credential stuffing: the real-world attack you face

Most people don't lose access to accounts because someone cracked their specific password — they lose access because they reused a password from a breached site. This is called credential stuffing: take leaked email+password pairs and automatically try them on hundreds of other services. Netflix, Spotify, Amazon, banks — all get credential stuffing attacks constantly.

If your password is "hunter2" everywhere, one breach compromises everything. This is why password reuse is the single biggest password mistake people make.

What Actually Makes a Password Strong

There's a lot of outdated advice about passwords. Let's go through what actually matters, based on modern NIST guidelines and cryptographic reality.

Length is the biggest factor

The strength of a random password grows exponentially with length. Adding one character to a 12-character password is worth more than swapping lowercase for uppercase throughout. Here's why:

Length	Pool (mixed)	Entropy	Time to crack (100B/s)
8 chars	94 chars	52 bits	Hours–days
12 chars	94 chars	79 bits	Centuries
16 chars	94 chars	105 bits	Longer than the universe's age
20 chars	94 chars	131 bits	Computationally impossible

At 12+ characters of genuine randomness, brute force becomes infeasible with current technology. At 16+, you have enormous security headroom for decades.

True randomness, not human-chosen "randomness"

Humans are terrible at picking random passwords. We unconsciously avoid certain patterns, cluster numbers at the end, capitalize the first letter, and use words or dates that mean something to us. Even when we think we're being random, we're not. The password Tr0ub4dor&3 feels random but follows exactly the patterns attackers test first.

Cryptographically generated randomness uses hardware-level entropy sources that produce genuinely unpredictable values. Browser tools that use crypto.getRandomValues() — unlike Math.random() which is predictable — produce passwords that have no patterns, no weaknesses, and can't be guessed by knowing something about you.

Character diversity matters, but less than you think

Adding symbols to a password increases the pool size from ~62 (alphanumeric) to ~94 characters, which increases entropy per character by about 60%. That's meaningful, but a 14-character alphanumeric random password is still stronger than a 10-character password with symbols. Use all character sets, but don't sacrifice length to add a single required symbol.

The Password Manager Argument

The only practical solution to the password problem is a password manager. Here's the logic:

• You need unique, strong passwords for every account
• You can't remember 50+ random 20-character strings
• So you either reuse weak passwords (bad) or use a manager (good)

A password manager stores all your credentials, encrypted, behind a single strong master password. You remember one thing; the manager handles everything else. Most will also:

• Generate strong passwords for new accounts
• Alert you when a saved password appears in a breach
• Autofill login forms so you never have to type passwords
• Sync across your devices

Which password manager?

Manager	Type	Cost	Notes
Bitwarden	Cloud, open source	Free / $10/yr premium	Best overall for most people
1Password	Cloud	$36/yr	Excellent UX, business features
KeePassXC	Local file	Free	No cloud — full control, manual sync
Dashlane	Cloud	$33/yr	Good UI, built-in VPN on premium
ProtonPass	Cloud	Free / included with Proton	Privacy-focused, open source

What Everyone Gets Wrong

Predictable substitutions

Replacing letters with numbers or symbols (a→@, e→3, i→1, s→$, o→0) is on every attacker's rule list. P@$$w0rd is trivially cracked. These substitutions don't add meaningful security — they just satisfy poorly designed password complexity requirements.

Appending numbers and symbols to words

The pattern word + number + symbol is one of the most-tested patterns in rule-based attacks. sunshine123!, football99#, Summer2024! — all extremely weak despite technically meeting most complexity requirements.

Using personal information

Birthdays, names, pet names, favorite sports teams, graduation years — attackers target these in personalized attacks. Social engineering + public social media data makes personal passwords much weaker than their entropy suggests. A random password can't be guessed by knowing your birthday.

Thinking 8 characters is enough

An 8-character password, even a genuinely random one with all character types, provides only about 52 bits of entropy. At 100 billion guesses per second (achievable with a $2,000 GPU), this can be exhausted in hours to days for the right hash type. 12 is the minimum. 16 is recommended. 20 is comfortable.

Understanding Entropy

Password entropy is the technical measure of unpredictability. It answers the question: if an attacker knew exactly how you generated your password, how many guesses would they need on average?

The formula is: entropy = log₂(pool_size^length), which simplifies to entropy = length × log₂(pool_size).

• Lowercase only (26 chars): 4.7 bits per character
• Alphanumeric (62 chars): 5.95 bits per character
• Full printable ASCII (94 chars): 6.55 bits per character

A 16-character password from the full printable ASCII set has 6.55 × 16 = 104.8 bits of entropy. To brute force this at 100 billion guesses per second would take approximately 2^104.8 / (10^11 × 31,536,000 seconds/year) ≈ 10^11 years. The universe is 1.38 × 10^10 years old. That's the scale of security you get from 16 random characters.

Two-Factor Authentication Changes Everything

Even with a strong, unique password, your account can be compromised if your password is phished or your device is compromised. Two-factor authentication (2FA) requires a second proof of identity — typically a code from an app, a hardware key, or an SMS message — in addition to your password.

With 2FA enabled, an attacker who gets your password still can't access your account without the second factor. This single change eliminates most account takeover attacks.

2FA methods ranked by security

1. Hardware security keys (YubiKey, Google Titan): Strongest. Immune to phishing because keys are domain-bound. From ~$25.
2. Authenticator apps (Authy, Google Authenticator, 1Password): Strong. TOTP codes expire every 30 seconds. Phishable but much harder than passwords alone.
3. SMS codes: Weakest 2FA option. Vulnerable to SIM swap attacks. Better than nothing, but use an authenticator app if available.

Enable 2FA on every account that supports it, starting with: email, your password manager, banking, and any account tied to your phone number.

What to Do Right Now

If you want to act on this instead of just reading about it, here's the priority order:

This week

• Install a password manager (Bitwarden is free and excellent)
• Change your email password to a 20+ character generated password
• Enable 2FA on your email and password manager accounts
• Check haveibeenpwned.com to see if your email appeared in any breaches

Over the next month

• Change passwords for all financial accounts to unique, generated passwords
• Enable 2FA on banking and investment accounts
• Update social media and any account that has payment info stored
• Review what accounts you've connected to Google/Facebook login — those become single points of failure

Ongoing

• Use your password manager to generate a unique password for every new account
• Don't reuse passwords, ever — including close variations of old passwords
• Enable 2FA wherever it's offered
• When a site announces a breach, change your password on that site immediately