Why Password Length Beats Complexity Rules
The combinatorics behind password strength, and why cryptographically secure randomness matters more than symbol requirements.
Password strength is fundamentally a combinatorics problem: how many possible passwords exist given a character set and length, and how long would guessing all of them realistically take?
The combinatorics
The number of possible passwords is (character set size)^(length). A 12-character password using only lowercase letters (26 possible characters) has 26^12 ≈ 9.5 × 10^16 possible combinations. Adding uppercase, numbers, and symbols (roughly 94 total printable ASCII characters) at the same length gives 94^12 ≈ 4.8 × 10^23 combinations — a much bigger number, but notice it came from the same 12-character length, just a larger alphabet.
Why length beats character variety
Compare two alternatives: a 16-character password using only lowercase letters (26^16 ≈ 4.3 × 10^22 combinations) versus an 8-character password using the full 94-character set (94^8 ≈ 6.1 × 10^15 combinations). Despite using a far more restricted character set, the longer password has roughly seven million times more possible combinations than the shorter, more "complex" one. Each additional character multiplies the total possibilities by the full alphabet size; each additional allowed character type only multiplies by a comparatively small constant factor.
Why the source of randomness matters just as much
None of this combinatorics math matters if the password generator's underlying randomness is predictable. JavaScript's "Math.random()" is fast but not cryptographically secure — with enough observed output, its internal state can theoretically be inferred. A properly built password generator instead uses the Web Crypto API's "crypto.getRandomValues()", which draws from the operating system's cryptographically secure random number source, specifically designed to resist this kind of prediction.
What "entropy" actually measures
Password entropy (measured in bits) is calculated as log₂(number of possible passwords) — it's just a different way of expressing the same combinatorics using base-2 logarithms instead of raw combination counts. That 16-character, lowercase-only password's ~4.3 × 10^22 combinations corresponds to roughly 75 bits of entropy. Security guidance commonly recommends at least 60-80 bits of entropy for important accounts — comfortably achieved by sufficient length alone, even without symbols.
Why unique passwords per account matter more than any single password's strength
Even an extremely strong individual password provides limited protection if it's reused across multiple accounts — a breach at any one service exposes the same password everywhere else it's used. This is precisely the problem password managers solve: generating (and remembering) a genuinely unique, sufficiently long password for every single account, rather than relying on human memory for password diversity.
Common mistakes to avoid
- Assuming a password with lots of symbols is automatically stronger than a longer password without them
- Reusing a strong password across multiple accounts, which undermines its strength at the account-security level even if the password itself is mathematically hard to guess
- Using predictable substitutions (like "P@ssw0rd") that pattern-matching attacks specifically anticipate, rather than genuinely random character selection
Generate a cryptographically secure password with the password generator, or a collision-resistant identifier with the UUID generator.