Password rules usually ask for complexity: an uppercase letter, a number, a symbol. The math of entropy shows that length matters much more, as long as the password is truly random.
What entropy measures
A random password of length L, drawn from N possible characters, has N^L possible values. Entropy is log₂ of that number, so it equals L × log₂ N bits. Each extra bit doubles the number of guesses an attacker needs.
Bits per character
log₂ 62equals5.95
Entropy
12 × 5.95equals71.5 bits
Average time
62¹² ÷ 2 ÷ 10,000,000,000/sequals5,112 years
Length vs complexity
Adding symbols grows the character set from 62 to 95, which raises entropy per character from 5.95 to 6.57 bits. Adding one more character to a letters-and-digits password adds a full 5.95 bits. So a 14-character password of letters and digits (83.4 bits) is stronger than a 12-character password with symbols (78.8 bits).
Attack speed matters too
- Online logins are rate-limited, so attackers get only a few guesses per second per account.
- If a password database is stolen, attackers guess offline. Slow hashes such as bcrypt allow thousands of guesses a second; fast, unsalted hashes allow billions.
That is why the same password can be safe for decades against one attack and weak against another.
The catch: humans aren't random
All of this assumes random characters. Passwords people invent follow patterns, such as dictionary words, names, dates and predictable substitutions, and attackers try those patterns first. A made-up password can have far less real entropy than its length suggests.
Tip: Let a password manager generate 16 or more random characters. At 62 characters per position, that is over 95 bits of entropy.