Password Security Basics: What Actually Makes a Password Strong

A password like P@ssw0rd123 looks complex — it has uppercase, lowercase, a symbol and numbers. But it's also one of the first things a password-cracking tool tries, because it follows a predictable pattern: a dictionary word with common substitutions (a→@, o→0) plus a number on the end. Cracking tools are built specifically to try these substitutions first, so the "complexity" adds almost nothing against a real attack.

This is the core problem with rules like "must contain a symbol and a number" — they push people toward predictable patterns instead of genuine randomness.

When an attacker has obtained a database of hashed passwords (from a data breach, for example), they don't guess passwords one at a time through a login form — that's slow and gets blocked by rate limiting. Instead, they run an offline attack: hashing huge numbers of candidate passwords locally and comparing them to the stolen hashes. Modern hardware, especially GPUs, can attempt many billions of hash guesses per second for weaker hashing algorithms.

Two main approaches are used together:

• Dictionary and rule-based attacks — starting from real words, names and previously leaked passwords, then applying common transformations (capitalization, substitutions, appended numbers). This is why P@ssw0rd123 falls quickly.
• Brute force — trying every possible combination of characters. This only becomes impractical when the password is long and genuinely random, because the number of combinations grows exponentially with length.

This is measured as entropy — roughly, how many random guesses an attacker would need on average before finding the password. Our Password Strength Checker estimates entropy and realistic crack times for any password you test, entirely in your browser.

Length matters more than complexity rules. Each additional character multiplies the number of possible combinations. A long password built from a wide character set is exponentially harder to brute-force than a short one, even a short one with symbols and numbers mixed in.

Genuine randomness matters more than "looking random." A password should not be based on a dictionary word, a name, a date, or a keyboard pattern (like qwerty123). True randomness — the kind a password generator produces using your browser's cryptographic random number source — cannot be predicted by dictionary or rule-based attacks.

Uniqueness matters as much as strength. A strong password reused across multiple sites is only as safe as the weakest site that stores it. See the section on credential stuffing below.

There are two solid approaches to generating a strong, memorable-enough credential:

• Random character strings (e.g. xQ7!mK2$pL9v) — maximum entropy per character, ideal when the password will be stored in a password manager and never typed from memory.
• Passphrases (e.g. four or five random, unrelated words strung together) — easier to type and remember, and can reach very high entropy if the words are chosen at random rather than as a meaningful phrase. The security comes from the number of possible words in the dictionary used and the count of words, not from the phrase "feeling" secure.

Both approaches beat a short, rule-compliant password. Use the Password Generator to create either style, with adjustable length and character sets.

Reusing the same password across multiple accounts creates a specific, common attack called credential stuffing: once one site is breached and passwords are leaked, attackers automatically try the same email-and-password combination against many other popular sites. A single reused password can cascade into multiple compromised accounts.

A password manager solves this by generating and storing a unique, high-entropy password for every account, so you only need to remember one master password (which should itself be a strong passphrase). This removes the practical tradeoff between "strong" and "memorable" for every account except one.

Never paste a real, currently-in-use password into a website you don't trust to check its strength — you have no way to verify the input isn't being logged or transmitted. Any strength checker you use should process the password locally in your browser and make no network request with the value. ToolDrawer's Password Strength Checker works this way: entropy, pattern detection and crack-time estimates are all calculated on your device.