What a strong password really is

Module 2: Passwords and logging in · Reading time: 9 minutes

Learning objective: After this lesson, you can explain why length and uniqueness matter more than odd characters, and what the current NIST guideline says about passwords.

Key concepts: length, entropy, passphrase, dictionary attack, brute force, reuse, mandatory changing

How a password gets cracked

When people think of "cracking a password", they often picture someone guessing at your login page. That happens, but it isn't the biggest threat. A good login page slows down after a number of wrong attempts or blocks temporarily. Guessing through the front door is therefore slow.

More dangerous is offline cracking. A website doesn't store your password itself (if it's done properly), but a hash: a kind of fingerprint from which you can't directly calculate the password. If a webshop's database leaks, the attacker has those fingerprints on their own computers. There's no brake there. They try as many passwords as their equipment can handle and compare each result with the leaked fingerprint.

They use two methods for this:

• Dictionary attack: first everything people often choose. Lists with millions of real passwords from previous leaks, words from dictionaries, names, places, years. Combined with fixed rules: capital letter at the start, year at the end, exclamation mark at the end, a becomes @, o becomes 0.
• Brute force: after that, all possible combinations of characters, from short to long.

A password like Zomer2026! looks strong: capital letter, digits, punctuation, ten characters. But it's exactly the pattern that's in those rules: a word, a year, a character. Such a password falls in the first round, long before brute force even begins.

Length beats odd characters

How strong a password is depends on how many possibilities an attacker has to try. You calculate that number like this: number of possible characters to the power of length.

On a standard keyboard there are 95 characters you can type (uppercase and lowercase letters, digits, punctuation and the space). A random password of 8 characters then has 95 to the power of 8 possibilities: roughly 6.63 × 10^15. That seems like a lot, but with fast equipment and a weak storage method, that's searched through within days.

Every extra character multiplies the number by 95. An extra type of character (for example adding punctuation to letters only) only multiplies the base by a small amount. That's why length delivers much more than complexity.

That last column is entropy: a measure of how unpredictable something is, expressed in bits. In plain language: every extra bit doubles the attacker's work. A password of 65 bits therefore costs not a bit more, but roughly 4,000 times more work than one of 53 bits.

Important: these numbers only apply if the password is genuinely random. A password you make up yourself is almost never random. Bakkerij2026! has thirteen characters, but in terms of pattern it's on every cracking list.

The passphrase

A passphrase is a password made up of a number of separate words, for example five or six. The advantage: long, yet easy to remember and type. The National Cyber Security Centre (NCSC) recommends choosing four to six words that have nothing to do with each other, and says that a long phrase with only lowercase letters is safer than a short password with every type of character.

A passphrase is only strong if the words are chosen randomly:

• Good: a generator (in your password manager) or dice with a word list. The well-known method with five dice uses a list of 7,776 words, because 6 to the power of 5 is exactly 7,776. The creators of such a list recommend six words for most uses.
• Wrong: a well-known phrase, song lyrics, a proverb or something about yourself. ikhouvanmijnhondbobby is long, but the words are connected and can be guessed by anyone who knows you or reads your social media.

A passphrase is still a password. You use it in one place and you don't share it.

Unique matters more than complex

The strongest password doesn't help if you use it in twenty places. In lesson 1.4 you saw credential stuffing: a leaked email address with password is tried automatically against mail, accounting, webshops and social media. If it leaks at the weakest of those twenty services, all twenty are open.

Reuse is therefore the biggest weakness in practice. And "a few variants" doesn't count as unique. Example!Mail and Example!Shop can be guessed in a few attempts by an attacker with one leaked password.

The solution isn't to remember, but to store: a password manager creates a long, random password for every service and remembers it for you. That's lesson 2.2. You then only need to remember a few things: the master password of the manager and possibly the password of your computer.

What the NIST guideline says

The American NIST (National Institute of Standards and Technology) publishes the best-known guideline for logging in: SP 800-63B. The fourth version became final on 31 July 2025. Many organisations worldwide follow it. The most important points for passwords:

• If the password is the only way of logging in, at least 15 characters. If it's part of two-factor authentication (2FA), at least 8.
• A service must allow passwords of at least 64 characters.
• No composition rules: a service may not require "at least one capital letter, one digit and one punctuation mark".
• Don't force periodic changes. Only change if there's an indication that the password has leaked.
• Check new passwords against a list of commonly used and leaked passwords.
• Allow pasting and password managers.
• No security questions ("name of your first pet") and no password hints.

Why mandatory changing is no longer recommended

For years, you had to choose a new password every three months at work. The idea: a stolen password then only works briefly. In practice, people do this: Zomer2026! becomes Herfst2026!, then Winter2026!. An attacker with the old password guesses the new one in a few attempts. And anyone who has to keep thinking up a new password chooses shorter ones and writes them on a note.

Mandatory changing therefore makes passwords more predictable. You do change immediately when there's a reason: a notification of a leak, a strange login, a colleague leaving who knew the password, or if you've accidentally entered it somewhere.

In practice: a password policy on one page

For a small business like Bakkerij Example, a short policy is enough:

1. Every account has its own, personal password. No shared login for info@example.com where five people know the password.
2. Passwords are created by the password manager: random, at least 15 characters, or a passphrase of at least five random words that you have to type.
3. Never the same password in two places.
4. Two-factor authentication (2FA) on for mail, accounting, bank, hosting and domain registration (lesson 2.3).
5. Only change for a reason, and then immediately.
6. Never send passwords by mail or chat, or write them on a note by the screen.

Your hosting panel follows this line too. In the WebOké environment, for example, you can have a random password generated for the DA password and for mailboxes; in other panels that button is often called "Genereer" or "Generate". Always let such a generator create at least 15 characters; you can often choose the length yourself.

Summary

• Attackers mostly crack offline, after a leak, with lists and rules. Predictable patterns fall immediately.
• Length and genuine randomness deliver much more than odd characters. Every bit of entropy doubles the work.
• A passphrase made of randomly chosen words is long yet easy to remember.
• Unique matters more than complex: reuse turns one leak into twenty leaks.
• NIST SP 800-63B-4: at least 15 characters as the only factor, no composition rules, no periodic changes, but do check against leaked passwords.

Quiz

Exercise

Exercise A2.1: Calculating and assessing. You don't enter any password of your own anywhere. Part 1: calculate how many possibilities a passphrase and a random password have (you're given the numbers of words and characters), which of the two is stronger and by how many times. Part 2: assess six made-up example passwords: predictable, too short, reused or strong. The program checks and gives an explanation for each answer.

Further reading

The steps in the WebOké articles apply to the WebOké environment; with other providers it works in a similar way.

• DirectAdmin guide 3.7: Secure passwords and what to do if a password is leaked
• How do I change the password or limits of my email address?
• NCSC, Tips for creating a strong password (Dutch): https://www.ncsc.nl/multifactor-authenticatie/tips-voor-het-bedenken-van-een-sterk-wachtwoord
• NCSC, Four steps to make your passwords safer (Dutch): https://www.ncsc.nl/multifactor-authenticatie/vier-stappen-om-je-wachtwoorden-veiliger-te-maken
• NIST SP 800-63B-4, Authentication and Authenticator Management: https://pages.nist.gov/800-63-4/sp800-63b.html
• EFF, Dice-Generated Passphrases (the word list used with dice): https://www.eff.org/dice