Why Do Passwords Have to Be Long?

Step 1 of 5

Each extra character multiplies the guesses.

Adding one character does not add a bit of difficulty — it multiplies the number of possibilities by the size of the alphabet. Four more characters can make it millions of times harder.

Step 2 of 5

The guessing is done by machine.

An attacker does not type. A program tries billions of combinations a second, starting with every word in every dictionary and every common substitution people think is clever.

Step 3 of 5

Common patterns are tried first.

Replacing an o with a zero, adding a 1 and an exclamation mark, using your team or your birthday — attackers try all of that before anything else, because that is what people actually do.

Step 4 of 5

Reusing one is the real danger.

If a site is broken into and your password taken, attackers immediately try it on your email and bank. One reused password turns somebody else's problem into all of yours.

Step 5 of 5

Sites should not know your password.

A careful site stores a scrambled version that cannot be turned back. It can check a password by scrambling what you typed and comparing, without ever holding the real thing.

Four random ordinary words are longer, stronger and far easier to remember than one short word full of symbols.