Passwords remain the front door to most systems, and almost everyone — users and developers alike — gets them subtly wrong. This guide covers what actually makes a password hard to crack, why the old "complexity rules" are misguided, and how passwords should be stored on the server so a breach does not become a catastrophe.
Strength is entropy, and entropy is mostly length
A password’s real strength is its entropy: the number of possibilities an attacker must try. Entropy grows with both the size of the character set and, far more powerfully, the length. A long passphrase of ordinary words can be dramatically stronger than a short string of mixed symbols, because each extra character multiplies the search space. This is why "length over complexity" is the modern guidance.
Why complexity rules backfire
Rules like "must contain an uppercase letter, a number and a symbol" feel secure but often reduce real-world strength. They push people toward predictable patterns — Password1!, capital at the start, symbol at the end — which cracking tools try first. A truly random password, or a long random passphrase, beats a rule-satisfying but predictable one every time.
Randomness matters most
The strongest password is long AND genuinely random. Human-chosen passwords cluster around predictable choices; a cryptographically random generator does not. Generating secrets with a secure random source — not a predictable one — is what makes them unguessable.
How passwords should be stored
On the server, passwords must never be stored in plaintext or with a fast hash like MD5 or SHA-256 alone. They should be hashed with a slow, salted algorithm designed for the job — bcrypt, scrypt or Argon2 — so that even if the database leaks, cracking the hashes is prohibitively expensive. The salt ensures identical passwords produce different hashes, and the deliberate slowness defeats mass brute-forcing.
The practical takeaways
- For users: use long, unique, random passwords — ideally from a password manager.
- For developers: store with bcrypt/scrypt/Argon2, never plain or fast-hashed.
- Never reuse a password across sites; one breach then compromises many accounts.