Here's a fact that surprises almost everyone: an 8-character password with uppercase letters, numbers, and symbols — the kind every signup form used to demand — has less entropy than a 16-character password made of nothing but lowercase words. Specifically, 52.4 bits versus 75.2 bits. The "strong password" rules most of us were taught for two decades were, mathematically, backwards. In August 2026, NIST rewrote its official password guidance (SP 800-63B) to reflect this: minimum length jumped to 15 characters, forced periodic rotation was formally killed, and the classic uppercase+number+symbol complexity rule is no longer recommended at all.
So how do you actually know if your password is strong? Not by pasting it into a random website that promises to "test" it — that's a privacy risk we'll explain below. This guide gives you the same self-check methodology security professionals use: a 12-point checklist, the real entropy math behind it, and a walk-through you can run entirely in your head. No account creation, no software install, no typing anything sensitive into a form field — just a structured way to reason about what actually makes a password resistant to the two very different ways attackers try to break it.
We'll also cover the specific case that deserves the strictest standard of all (your password manager's master password), the practical Diceware method for generating genuinely random passphrases without relying on your own brain's "randomness" (which is never as random as it feels), and a prioritized action plan if your self-check score comes back lower than you'd like.
Don't paste your real password into a "checker" site
Dozens of free "password strength tester" websites exist, and most ask you to type your actual password into a text field. Even if the tool is honest, that password now exists in browser memory, possibly in a network request log, possibly in a third-party analytics script running on the page. The self-check below needs only the structure of your password (length, character types, where else it's used) — never the password itself.
Password Strength: What the Math Actually Says
Every password's resistance to automated guessing can be expressed as a single number: entropy, measured in bits. The formula is simple: entropy = length × log2(character set size). A larger character set (adding uppercase, numbers, symbols) increases entropy per character, but adding length increases entropy multiplicatively across every additional character — which is why length wins so decisively.
| Password Example (structure, not real) | Length | Character Set | Approx. Entropy | Est. Offline Crack Time* |
|---|---|---|---|---|
| Word + year (e.g. pattern like "Hockey2026") | 10 | Mixed, dictionary-based | ~24 bits | Under 1 second |
| 8-char, upper+lower+digit+symbol | 8 | 94 chars | ~52 bits | Minutes to hours |
| 16-char, lowercase words only | 16 | 26 chars | ~75 bits | Centuries |
| 20-char, lowercase passphrase (4-5 random words) | 20 | 26 chars | ~94 bits | Far beyond any practical attack |
*Estimates for offline brute-force against a properly hashed database (e.g. bcrypt). Real-world attacks almost always target reused or dictionary-pattern passwords first, which is why structure matters more than raw entropy in practice.
Think an account may already be compromised?
Our certified bilingual techs can check for signs of unauthorized access, lock down your accounts, and set up a password manager properly — same day, from $119.99.
The 12-Point Self-Check
Answer each question honestly about one specific password you use regularly (a work login, your email, your bank). You don't need to write the password down — just know its shape.
Scoring yourself
10-12 "yes" answers: genuinely strong password hygiene. 6-9: workable but has real gaps — prioritize fixing reuse and length first. Under 6: treat this password as compromised-by-default and replace it, starting with your email and banking logins.
How to Calculate Your Own Password's Entropy (3-Minute Walkthrough)
Identify your character set size
Lowercase letters only = 26 possible characters. Add uppercase = 52. Add digits 0-9 = 62. Add common symbols = roughly 94. You don't need the exact count — just note which categories your password actually uses.
Count the length
Count every character, including spaces if you use a passphrase with spaces between words.
Apply the formula: entropy (bits) = length × log2(character set size)
Reference values: log2(26) ≈ 4.7, log2(52) ≈ 5.7, log2(62) ≈ 5.95, log2(94) ≈ 6.55. Example: a 16-character password using only lowercase letters = 16 × 4.7 ≈ 75 bits. An 8-character password using the full 94-character set = 8 × 6.55 ≈ 52 bits. The 16-character lowercase password wins despite "looking" simpler.
Compare against the threshold
Below 40 bits: weak, crackable in practical time with consumer hardware. 40-80 bits: moderate, adequate for low-value accounts with MFA enabled. 80+ bits: strong, the target for email, banking, and password-manager master passwords.
This formula assumes true randomness
The math above assumes each character is chosen unpredictably. A password that "looks" random but follows a personal pattern (initials + birth year + favorite symbol) has far less real entropy than the formula suggests, because a targeted attacker who knows you can guess the pattern, not just brute-force every combination. The self-check questions above (personal info, dictionary words, keyboard patterns) exist precisely to catch this gap between theoretical and real-world entropy.
Why Your Password Manager's Built-In Strength Meter Is (Usually) Trustworthy
Unlike a random third-party "checker" website, the strength meter built into a password manager like Bitwarden or 1Password runs entirely client-side in your browser or app — the password never leaves your device to be evaluated. That's the key distinction: it's not that all strength-checking tools are dangerous, it's that you need to know whether the evaluation happens locally (safe) or via a server-side submission (risky, avoid with real credentials). If you're ever unsure, use the manual self-check in this guide instead — it requires zero trust in any third party.
The Anatomy of a Password Attack: What's Actually Happening
Self-check questions make more sense once you understand what an attacker is actually doing on the other end. There are two fundamentally different attack modes, and they favor different weaknesses.
Online attacks: guessing against a live login form
In an online attack, the attacker submits guesses directly to a website's login page. This is slow and noisy — most services lock an account or trigger a CAPTCHA after 5-10 failed attempts. Online attacks almost never brute-force random combinations; instead they use credential stuffing: taking a list of email/password pairs leaked from one breached site and trying the exact same pairs against banks, email providers, and other services, betting on reuse. This is why self-check question #2 (uniqueness) matters more than raw entropy against this specific attack type — a 20-character passphrase reused on three sites is instantly worthless the moment any one of those three is breached.
Offline attacks: cracking a stolen password database
In an offline attack, a company's user database has already been stolen (via a breach), and the attacker has the hashed passwords sitting on their own hardware with no rate limit, no lockout, and no CAPTCHA. This is where entropy math becomes decisive — GPU cracking rigs can attempt billions of hashes per second against poorly-hashed databases. A properly "salted and hashed" database (using bcrypt, scrypt, or Argon2) slows this down dramatically, but a weak password (low entropy, dictionary-based) still falls quickly regardless of how the database was protected, because the attacker's dictionary tries the most likely passwords first, not a blind sequential search.
What "salting and hashing" actually means (and why it matters to you)
A well-run service never stores your actual password in its database — it stores a hash, a one-way mathematical transformation of the password that can't practically be reversed. If two users happen to pick the identical password, a naive system would produce identical hashes, letting an attacker pre-compute a giant lookup table (a "rainbow table") mapping common passwords to their hashes and instantly reverse-match any entry found in a stolen database. Salting fixes this by mixing a unique random value into each password before hashing, so even identical passwords produce different stored hashes and rainbow tables become useless. This is entirely the service's responsibility, not yours — you can't tell from the outside whether a site salts and hashes properly. What you can control is entropy: even against a well-salted, slow, modern hash algorithm (bcrypt, Argon2), a low-entropy dictionary password is still one of the first things tried and one of the first to fall.
Why the LinkedIn, Adobe, and Yahoo breaches are still relevant a decade later
When security researchers later analyzed the leaked LinkedIn, Adobe, and Yahoo password databases, a pattern emerged that reshaped official guidance: users under stricter complexity policies did not end up with more secure passwords — they ended up with more predictable ones. Forced complexity and forced rotation pushed people toward patterns like "Company123!" that satisfied the rule but were trivially guessable once the pattern itself became public knowledge. This finding is a direct reason NIST dropped mandatory complexity and rotation rules in its 2026 revision of SP 800-63B.
Special Case: Your Password Manager's Master Password
One password deserves stricter self-check standards than any other: the master password protecting your password manager vault. Since it's the single key protecting every other credential you own, it should clear every one of the 12 checks with room to spare — treat 100+ bits of entropy as the real target, not the 80-bit general threshold. Because you only need to remember this one password (the manager handles the rest), there's no excuse for cutting corners: a 6-word random passphrase comfortably exceeds 100 bits and is still memorable enough to type from memory daily.
Common Mistakes Even Security-Conscious People Still Make
Using a "strong" password structure, then reusing it everywhere
A 20-character passphrase used on 30 different accounts is not 30 strong passwords — it's one strong password protecting 30 accounts equally, and a single breach anywhere in that list compromises all 30 at once via credential stuffing.
Treating security questions as a backdoor around a strong password
"What's your mother's maiden name" and "what city were you born in" are frequently public record or discoverable via social media, and account-recovery flows built on these questions can bypass even a perfect password entirely. Where possible, use a password manager to generate a random, unrelated answer to security questions and store it like a second password.
Assuming a long password is automatically a random password
"iloveyoumorethananythingintheworld" is 35 characters long but has very low real-world entropy — it's a coherent English sentence, and phrase-based cracking dictionaries specifically target grammatically plausible strings. Length only translates to entropy when each unit (character or word) is chosen unpredictably.
Storing passwords in a browser's built-in autofill without a master PIN
Browser-saved passwords are convenient but are typically protected only by your operating system login, which is often easier to bypass locally (shared computers, stolen unlocked devices) than a dedicated password manager's separate encrypted vault with its own master password and auto-lock timer.
How to Build a Strong Passphrase From Scratch (The Diceware Method)
If you'd rather build a genuinely random passphrase than trust your own brain to "think random" (human-picked words are never truly random — we unconsciously gravitate toward familiar, memorable, and therefore guessable words), security professionals use a method called Diceware. It's simple enough to do by hand and removes human bias entirely.
Get a numbered word list
A Diceware word list contains thousands of common, easy-to-spell words, each indexed by a unique 5-digit number (from rolling five dice). The original EFF Diceware word list is free and widely available.
Roll physical dice (or use a cryptographically random generator)
Roll five six-sided dice, record the digits in order, and look up the corresponding word. Repeat 5-6 times to get 5-6 words. Physical dice matter here — a method you fully control and can verify beats trusting an unknown website's "random" word generator.
String the words together
Join the words with spaces, hyphens, or nothing at all: "granite-plumbing-echo-tidal-woven-8" is an example structure (never reuse this exact example). Five random Diceware words already exceed 64 bits of entropy; six words comfortably exceed 77 bits — well into the "strong" range from the self-check above.
Add one number or symbol if a site requires it
Some login forms still enforce old-style complexity rules despite NIST's updated guidance. If forced, insert a digit or symbol in the middle of the passphrase (not the end) — position slightly increases resistance to pattern-based dictionary attacks that specifically check for suffix patterns first.
Password Strength Requirements by Account Type
Not every account carries equal risk. A reasonable, sustainable approach tiers your effort based on what's actually at stake if that specific password is compromised.
| Account Type | Minimum Target | Why |
|---|---|---|
| Password manager master password | 100+ bits (6-word passphrase) | Single point of failure for every other credential you own |
| Primary email | 90+ bits + MFA | Controls password-reset flows for nearly every other account |
| Banking / financial | 90+ bits + MFA | Direct financial loss, often time-limited to dispute |
| Work / corporate login | 90+ bits + MFA | Breach can expose employer data, coworkers, clients |
| Social media | 80+ bits | Reputational and social-engineering risk if hijacked |
| Low-value forums / newsletters | 60+ bits, unique | Low individual risk, but reuse still endangers other accounts |
Notice "unique" appears on every single row without exception — it's the one requirement that never scales down, regardless of how low-stakes an individual account seems, because the risk isn't really about that one account. It's about every other account that would share the exposure the moment this one is breached.
Password Fatigue Is Real — Here's Why It Doesn't Have to Break Your Security
The average internet user now maintains somewhere between 70 and 150 online accounts. Trying to memorize a unique, high-entropy password for each one is not a realistic personal policy — it's the exact pressure that pushed people toward reuse and predictable patterns in the first place. This is precisely the problem a password manager is designed to solve: you memorize exactly one strong master password (built using the Diceware method above), and the manager generates, stores, and auto-fills a unique random string for every other account. The self-check in this guide is meant to be applied to a small handful of passwords you actually type from memory — your master password, perhaps a device PIN — not to every login you'll ever create.
A note on writing passwords down
Contrary to older advice, security professionals now generally agree that writing a strong master password on paper and storing it somewhere physically secure (a locked drawer, a safe) is safer for most people than reusing a weaker, memorable password across many accounts. The realistic threat for most individuals is remote credential theft, not someone breaking into your home specifically to steal a sticky note — though a password manager with recovery options remains the better long-term solution.
What to Do Right Now If You Scored Low on the Self-Check
If your self-check score came back under 6, don't try to fix everything today — prioritize in this order, which mirrors where real-world attackers actually focus first:
- Change your email password first. It's the master key to resetting every other account, so it should be first in line regardless of how strong or weak the others are.
- Enable MFA on email and banking immediately, even before you've fixed the password itself — MFA blocks most account-takeover attempts even against a currently weak password.
- Install a password manager and let it generate new, unique, high-entropy passwords for your 5-10 most important accounts before tackling every account you own.
- Run a breach check on your email address (Have I Been Pwned lets you check an email, not just a password) to see which specific accounts need the most urgent attention.
- Work through the rest gradually. Trying to replace 50+ passwords in one sitting leads to burnout and shortcuts — a steady pace with a password manager doing the heavy lifting is more sustainable than a single all-nighter.
Frequently Asked Questions
Is it safe to type my real password into an online password strength checker?
No — treat any site that asks you to paste your real password as untrusted by default. Even honest tools can log form submissions or run third-party scripts that capture the input field. Use the self-check method in this guide instead, since it only requires knowing your password's structure, not the password itself.
Does adding a number and a symbol at the end make a weak password strong?
No. Cracking dictionaries already include "word + 1!" as a default pattern, so "Password1!" is cracked in under a second by modern hardware despite technically passing old-school complexity rules. Length and unpredictability matter far more than tacked-on symbols.
How long should a password be in 2026 to be considered strong?
NIST SP 800-63B (2026 revision) sets 15 characters as the recommended minimum for single-factor passwords. A 20-character random passphrase of ordinary lowercase words beats an 8-character password stuffed with symbols, because entropy scales with length faster than with character-set variety.
Is a passphrase actually more secure than a complex password?
Yes, when built correctly with 4-5 random, unrelated words rather than a famous quote. A 20-character lowercase-only passphrase reaches roughly 94 bits of entropy, comfortably beating an 8-character complex password's roughly 53 bits.
How do I know if my password has already been leaked in a data breach?
Use a k-anonymity breach-check service such as Have I Been Pwned's Pwned Passwords feature, which checks exposure without transmitting your full password. Most password managers run this check automatically and flag reused or breached credentials in your vault.
Should my password manager's master password follow different rules than my other passwords?
Yes — treat it as the single highest-priority password you own. Since it's a zero-knowledge encryption key protecting every other credential in your vault, aim for 100+ bits of entropy (a 6-word random passphrase is a good target) rather than the general 80-bit threshold used for everyday accounts.
Is it true that online attacks and offline attacks require different password defenses?
Yes. Online attacks (guessing against a live login form) are usually credential-stuffing attempts that exploit password reuse, so uniqueness matters most there. Offline attacks (cracking a stolen, already-breached password database) exploit low entropy directly, so length and unpredictability matter most there. A genuinely strong password needs to defend against both.
Bottom Line
Password strength isn't about satisfying an arbitrary complexity rule from a signup form — it's about entropy (unpredictability across a realistic length), uniqueness (so one breach doesn't cascade into ten), and layered defense (MFA covering the gap even when a password eventually fails). The 12-point self-check above gives you a repeatable way to reason through all three without ever having to trust a third-party website with your actual credentials. Run it once now on your most important accounts, fix what's weakest first using the priority order above, and let a password manager carry the load for everything else going forward.
Not sure your accounts are actually secure?
IT Cares can audit your password hygiene, set up a password manager correctly, and enable MFA across your critical accounts. Remote sessions available same-day.
Comments (3)
Ran the entropy math on my banking password and was shocked — 9 characters with symbols came out to only 59 bits, way less than I assumed. Switched to a 4-word passphrase, much easier to remember too. Wish someone had explained the actual math to me years ago instead of just "use more symbols."
The Have I Been Pwned tip was new to me — didn't realize you could check a password's exposure without actually sending the password. Found out two of my old passwords were in breach lists. Getting a password manager set up this weekend.
Scored 5/12 on the self-check, mostly because of reuse across work and personal accounts. Called IT Cares to help set up a proper password manager and MFA across everything — done in under an hour, worth it.
Leave a Comment