Password strength beyond “8 characters”

Published: 2026-07-20

Entropy, dictionary attacks, and zxcvbn-style scoring — why length and uniqueness beat complex rules on a sticky note.

Policy text still says “one uppercase, one number, one symbol” — but length and unpredictability dominate resistance to guessing. A 16-character random passphrase beats P@ssw0rd1 on every hardware budget. Measuring strength offline helps you compare options without sending passwords to a server.

Entropy in plain language

Entropy (bits) estimates how many guesses an attacker needs on average. Each additional uniformly random bit doubles the search space. Rough guide:

  • < 40 bits — weak for high-value accounts
  • 60–80 bits — reasonable for memorized passphrases with random words
  • 128+ bits — typical of generated secrets and API keys

Human-chosen passwords have far less effective entropy than the character set suggests because people follow patterns.

Dictionary and breach attacks

Attackers do not brute-force aaaaaa through zzzzzz first. They use:

  • Dictionary words and leetspeak variants (p@ssword)
  • Breached password lists from prior leaks
  • Keyboard walks (qwerty, 1qaz2wsx)

Tools like zxcvbn (used in LocalTools) model these patterns and estimate crack times under offline attack assumptions.

Passphrases vs complex short passwords

Approach Pros Cons
Random 20+ char High entropy, generator-friendly Hard to type on TV remotes
4–6 random words Memorable, high entropy if words are random Leaked if you reuse the sentence
8 char complex rules Passes naive policies Low entropy, predictable patterns

Use a password manager for unique secrets per site; measure master password strength separately.

What not to paste anywhere

Never type production passwords into untrusted websites — including “strength meters” that POST to a server. Prefer offline analysis in your browser or CLI. LocalTools does not upload your input for scoring.

Try it locally

The Password Strength & Entropy Analyzer runs zxcvbn and entropy estimates in-tab, with crack-time tiers for different hardware assumptions.

Generate high-entropy candidates with the Random String Generator and read Generating passwords and tokens in the browser.

Related reading

← All learn articles