# Your password is not weak because it is short. It is weak because it is yours.

> “Summer@2024” has a capital, a number and a symbol, and it still falls in seconds. The maths of guessing, why length beats cleverness, and the one habit that protects you more than any password rule.

Published 2026-10-07 by Toolcloak. 5 minute read. Original: https://toolcloak.pages.dev/articles/your-password-is-not-weak-because-it-is-short
Related free tool: [Password Generator](https://toolcloak.pages.dev/tools/password-generator)

Think of the last password you were proud of. It probably had a name or a place in it, a year, a capital letter at the start and an exclamation mark at the end. The site gave you a green bar that said “strong”. You felt safe.

The trouble is that password cracking programs were written by people who have also been proud of that exact password. They try “Priya@1998” and “Mumbai#2024” early, because humans are wonderfully predictable. So the first thing to understand is that password strength is not about how it looks. It is about how many other things it could have been.

## How guessing really works

Nobody sits at a login page typing guesses. The realistic attack starts after a company is breached and its list of password fingerprints (hashes) leaks. The attacker then guesses offline, on their own machines, with no lockouts and no alarms. Against a fast, badly protected hash, modern graphics hardware can try **billions of guesses per second**. We will use 10 billion a second below, a deliberately generous figure for the attacker.

Two kinds of guessing happen:

- **Dictionary attacks** try real words, names, leaked passwords and common patterns first, together with the usual tricks: capital at the front, a number at the end, “a” turned into “@”.
- **Brute force** tries every combination, shortest first. It only matters for passwords that are truly random, which is the only kind worth having.

A password that a human invented lives almost entirely in the first group. A password that a computer invented lives in the second. The gap between them is enormous.

## Counting the possibilities

A random password drawn from lowercase letters only has 26 options per position. Eight characters gives 26 to the power 8, about **208 billion** combinations. That sounds big until you divide by 10 billion guesses a second. On average the attacker finds it in roughly ten seconds.

Mix in capitals, digits and symbols and you have about 94 options per position. Eight characters is now 6.1 quadrillion combinations, which holds for around three and a half days on average. Better. Still a weekend project.

Now keep the same 94 symbols and stretch it. Twelve characters is 94 to the 12th power. At the same guessing speed, the average time to crack is about **750,000 years**. Same alphabet, four more characters. Length does what cleverness cannot.

**Strength in bits (each extra bit doubles the work)**

|  | Bits of randomness |
| --- | --- |
| 8 lowercase letters, random | 37.6 bits |
| 8 letters, digits, symbols | 52.4 bits |
| 4 random dictionary words | 51.7 bits |
| 6 random dictionary words | 77.5 bits |
| 12 random characters | 78.7 bits |
| 16 random characters | 104.9 bits |

*Bits measure how many guesses a random password takes: n bits means 2 to the power n possibilities. The word-based rows assume words picked at random from a list of 7,776, as in the diceware method. These are random passwords. Anything you invented yourself is far weaker than its length suggests.*

Notice something odd in that chart. A phrase of **four random words** matches an eight-character jumble of symbols, and six random words matches twelve random characters. The reason is that words come from a big list, and a random choice from 7,776 words is worth almost 13 bits all by itself.

This is why “correct horse battery staple” became a famous example. But note the word **random**. A line of a song or a quote from a film is not random, and it is in the attacker's word list before you finish typing it.

Try it: [Password Generator](https://toolcloak.pages.dev/tools/password-generator). Length from 8 to 128, four character types, one-click copy. Built on your browser's secure random generator.

## The real danger is reuse

Here is the part that matters more than the maths. Suppose you have a perfect twenty character password. You use it on your email, your shopping app and a small hobby forum. The forum gets breached, because small sites often have weak security, and the attacker now has your email and your password.

They do not crack anything. They try that pair on every popular service in the world, automatically, in minutes. This is called **credential stuffing**, and it is how most accounts are actually taken over. Your strong password was useless the moment you used it twice.

> **The rule that beats all other rules:** One site, one password. If you only fix one thing after reading this, make it your email account, because every “forgot password” link in the world lands there. Give that one a password that exists nowhere else.

## So how do I remember forty of them?

You do not. That is the point of a password manager: it remembers, you do not, and so the passwords can be fully random and different everywhere. You memorise exactly **one** strong passphrase, the one that opens the manager, and nothing else.

Your browser's built-in manager, or a dedicated one, will fill them in for you. Either is vastly better than a notebook of variations on the same name, which is what most of us have in our heads right now.

For that single master passphrase, use the word method. Pick four to six words completely at random (dice and a word list are best, if you can be bothered) and string them together. Do not choose words that mean something to you.

## Where the random comes from

Not every “random” is equal. Programmers have a casual function, `Math.random()`, that is fine for shuffling a playlist and **not** fine for secrets, because its output can be predicted. A proper generator uses the browser's cryptographic source, `crypto.getRandomValues()`, which draws on unpredictable data from your operating system.

Toolcloak's generator uses that secure source, runs on your device, and does not save or send what it makes. This is also how you should judge any online generator: if it needs a server to give you a password, the password has already been somewhere you did not choose.

## A thirty minute fix for this weekend

1. Open your **email account** settings and change the password to a long random one. Turn on two-step verification at the same time.
2. Do the same for your **bank, UPI and shopping apps**. These are the ones where a stranger can spend your money.
3. Install or turn on a **password manager** and save what you just created.
4. Work through the rest over the next few weeks, one account when you next log in. Use a length of 16 or more and let it fill all four character types.
5. Where you can, add an **authenticator app** or a passkey. A stolen password then stops being enough.

None of this is exciting. That is exactly why it works: boring habits repeated are what keeps accounts safe, far more than a clever password ever did.

> **Check what you already have:** Our [Password Strength Checker](https://toolcloak.pages.dev/tools/password-strength-checker) is a quick way to see how weak a human-made password really is. Do not type a password you currently use into any website that is not yours. This one runs only in your browser, but the habit is worth keeping.

## Frequently asked questions

### How long should a password be?

For anything important, 16 characters or more when generated randomly. A random 12 character password is already very strong, and the extra four give you a wide margin. For a master password you must remember, use four to six random words.

### Are symbols necessary?

They help a little, but length helps far more. Going from 8 to 12 random characters makes a password millions of times harder to guess, while adding symbols to an 8 character one multiplies the difficulty by a few thousand. If a site demands symbols, a password generator will include them for you.

### Is it safe to use an online password generator?

Only if it generates the password on your own device. A generator that runs in your browser using the secure random API never needs to send anything out. One that works through a server has seen your password before you did.

### What is a passphrase?

A password made of several random words, such as four to six picked from a large list. It is easy to remember and, when the words are truly random, very hard to guess.

### Should I change my passwords regularly?

Frequent forced changes mostly push people towards predictable patterns. Change a password when there is a reason: a breach, a shared device, or suspicious activity. Otherwise a long, unique password plus two-step verification is the better investment.