Password Length vs. Complexity: Which One Actually Stops Hackers?

Two passwords walk into a leaked database. The first is P@ssw0rd!9 — ten characters, a capital letter, a number, a symbol. It looks strong. The second is vnqkeltrazofimsp — sixteen characters, all lowercase, no symbol anywhere. It looks careless.

The second one is the harder target, and not by a small margin. The first password is a common phrase wearing a disguise that cracking tools have known about for years. The second has no pattern to grab hold of, and its extra characters multiply an attacker's workload into the millions. Length and complexity both add security, but they don't add it equally — and that difference matters when you're the one choosing what to type into a signup form.

How a cracking tool actually spends its time

Nobody starts by trying every possible combination of characters. That would burn hours on nonsense like xq7#mZ before ever reaching the passwords real people type. Instead, the tools work down a priority list, cheapest guesses first:

1. Passwords that have already leaked, ranked by popularity. The same few thousand entries — password, 123456, iloveyou, the name of the site you're on — show up in breach after breach.
2. Dictionary words and common names, in every language the tool supports.
3. Mangled versions of those words: first letter capitalised, letters swapped for lookalike digits, a year or an exclamation mark bolted onto the end.
4. Keyboard patterns and personal data: qwerty, 1qaz2wsx, birthdays, postcodes, phone numbers, sports teams.
5. Raw brute force — every combination — only once the cheap guesses are exhausted.

Steps one through four cover an astonishing share of real passwords for almost no effort. Your password only gets the full brute-force treatment if it doesn't resemble anything on that list, and that is exactly where length starts to pay you back.

Why length does more of the heavy lifting

Each character you add multiplies the number of guesses required. If your password uses only lowercase letters, every extra character multiplies the possibilities by 26. If it uses the full range of letters, digits and symbols — roughly 94 characters on a standard keyboard — each addition multiplies by about 94.

That sounds like complexity wins, until you compare real examples. An eight-character password drawn from those 94 characters has around six quadrillion possible combinations. A sixteen-character password using only lowercase letters has vastly more — on the order of seven million times more. Adding eight lowercase letters beats adding the entire symbol set to a short password.

The catch is the word random. Length only helps if the characters aren't predictable. abcdefghijklmnop is long and worthless. ilovemyjob2024! is long and falls apart in seconds because it's a sentence plus a year, and the tools try sentences plus years constantly.

Where complexity still earns its keep

Complexity isn't pointless. It defends against the dictionary stage of an attack. A password made of ordinary words with no variation gets caught early; a genuinely mixed one forces the attacker past that stage into territory where the search takes real time.

The trap is that most human complexity isn't complex at all. Ask ten people to make a password stronger and nine will capitalise the first letter, swap an o for a zero, and add a ! at the end. Those are the first rules loaded into every cracking configuration. If a machine can predict how you'll decorate a word, you've paid the price of complexity — harder to remember, harder to type on a phone — and bought almost nothing.

Genuine randomness is the useful kind. A password manager generates it for you, which is why "random" and "memorable" no longer have to be the same password.

What length should you actually aim for

For anything you care about, treat sixteen characters as a floor, not a stretch goal. Twenty or more is better, and there's no real cost once a manager is doing the typing. Short of a stolen hash plus a very slow, well-chosen hashing algorithm, longer is simply harder.

If you want to remember it, use a passphrase — carefully

A passphrase is several words strung together. The trick is to use enough words and pick them at random rather than choosing a phrase you like. Three words is weak: a short word list plus predictable tastes makes it guessable. Five or six randomly chosen words gives you serious length with something you can actually recall. If a phrase has meaning to you — a lyric, a quote, an inside joke — it isn't random, and someone who knows you may guess it.

One more factor matters: how the site stores your password. A well-built service hashes passwords with a deliberately slow algorithm, so each guess costs an attacker more. A poorly built one may use something fast, or store it in plain text. You can't see which is which, so assume the worst and give every account something long and unique.

What to do this week

Debating length against complexity is less useful than fixing the handful of accounts that would hurt most if they fell.

• Check your email and banking logins first. Those two unlock everything else. Give them long, unique passwords and turn on two-factor authentication.
• Stop reusing passwords. Reuse turns one forgotten forum breach into a problem across your whole life. Credential-stuffing attacks exist purely to exploit it.
• Let a password manager generate and store the random ones. Then you only need to remember one strong passphrase — the key to the manager itself.
• Make that master passphrase long. Six random words, no reused phrase, no song lyric. Write it down and store it somewhere physical if you need a backup.
• Turn on two-factor authentication wherever it's offered. It won't rescue a weak password, but it stops an attacker who already has it.

Length beats cleverness. Cleverness corrupts into patterns; length, when the characters are random, just keeps multiplying. Pick a long one, make it unique, and let the software remember it for you.

Photo: MART PRODUCTION / Pexels