/digitaldrive/images/Digital_Drive_logo.png){kind=logo}
Digital Drive
IT Solutions
Why Length Matters More Than Complexity.
Passwords are one of those things we all use every day—but they're also one of the easiest parts of security to get wrong.
For years, we've been told that a secure password needs uppercase letters, lowercase letters, numbers, and special characters.
So something like:
Tr0ub4dor!23
looks secure.
But appearances can be misleading.
A password can contain all the "right" ingredients and still be relatively weak if it is short, predictable, reused, or based on information an attacker can guess.
For most people, a long, unique passphrase is a better approach.
The distinction is fairly simple.
A password is often a relatively short string of characters designed around complexity:
Tr0ub4dor!23
A passphrase is generally longer and may consist of several unrelated words:
Coffee-River-Moon-Bicycle
The second example is much easier for a person to remember and type, while providing substantially more length.
And when it comes to resisting guessing attacks, length matters.
A common misconception is:
"My password has uppercase letters, numbers, and symbols, so it must be strong."
Not necessarily.
Attackers don't always guess passwords one character at a time. Modern password-cracking tools can work through enormous numbers of possible combinations, use dictionaries, identify common patterns, and take advantage of passwords that follow predictable rules.
For example, people commonly make predictable substitutions:
a → @o → 0i → 1adding 123adding !capitalizing the first letter
So a password that appears complicated to a human may not be particularly surprising to an automated attack.
Complexity can help, but predictable complexity isn't the same thing as randomness.
Consider the difference between:
Tr0ub4dor!23
and:
Coffee-River-Moon-Bicycle
The second one is substantially longer.
It is also easier to remember without writing it down.
That's an important combination.
A good passphrase should ideally be:
LongUniqueDifficult to predict. Easy enough for you to use correctly.
You don't need to turn every password into an impossible string of random characters that you'll immediately forget.
As a practical rule, longer is generally better.
A passphrase containing several unrelated words can provide substantial length without becoming difficult to remember.
For example:
Coffee-River-Moon-Bicycle
is easier to remember than:
C0ff33!R!v3r#M00n$B1cyc13
The second looks much more complicated.
But if you created it using predictable substitutions, you've mostly added complexity without making your life easier.
The goal isn't to make a password look complicated.
The goal is to make it difficult to guess.
This is one of the most important rules of password security:
Don't reuse passwords.
If you use the same password on multiple websites and one of those sites is compromised, attackers may try the stolen credentials against other services.
This is known as credential stuffing.
For example:
Email → Shopping → Banking → Social Media
If they all use the same password, compromising one account can potentially put the others at risk.
A unique password or passphrase for every important account limits the damage.
And this is where a password manager becomes extremely useful.
You don't need to memorize dozens—or hundreds—of unique passwords.
Instead:
Password manager
→ generates strong unique passwords→ stores them securely→ fills them when needed→ lets you use a different password for every account
You only need to protect the password manager itself with a strong master credential and appropriate additional security.
Passwords aren't your only layer of defense.
Multi-Factor Authentication (MFA) adds another layer of protection by requiring additional evidence that you are actually the person trying to sign in.
Depending on the service, this might involve:
an authenticator appa hardware security keya passkeya push notificationan SMS code
Not all MFA methods provide the same level of protection, but MFA is generally far better than relying on a password alone.
Think of it as layers:
Strong unique password/passphrase↓Password manager↓MFA
Each layer addresses a different part of the problem.
For more information on MFA, check out this post!
Avoid passwords or passphrases based on information that someone could discover about you.
That includes:
namesbirthdayspetschildrenbusinessesfavourite sports teamsaddressesphone numberspublicly available information
Something may be memorable to you while also being easy for someone else to discover.
Instead, use unrelated words or let a password manager generate a truly random password.
A password written on a sticky note beside your computer isn't protected by your firewall.
Neither is a text file containing:
Facebook: password123 Email: password123 Banking: password123
It sounds obvious, but people still do it.
Use a reputable password manager rather than keeping a plaintext list of credentials.
Password security isn't really about creating the most complicated password possible.
It's about creating good security boundaries.
A strong approach looks something like this:
LongMake it difficult to guess.
UniqueDon't let one compromised account expose another.
ManagedUse a password manager rather than relying on memory.
ProtectedUse MFA wherever practical.
UnpredictableDon't base credentials on information about yourself.
That's much more useful than simply being told:
"Use uppercase letters, lowercase letters, numbers, and symbols."
You don't need to change every password you have ever created at once.
Start with the accounts that matter most:
Primary emailBanking and financial accountsPassword managerCloud storageSocial mediaImportant business accounts
Make sure each has a unique credential and enable MFA where available.
Then work through the rest over time.
Your password doesn't have to be impossible to remember.
It needs to be difficult to guess, unique to the account, and protected by additional security where possible.
For many situations, a long, unique passphrase is easier to use and remember than a short password packed with symbols.
And remember:
Length is doing the heavy lifting.
Good password security isn't about making things unnecessarily complicated.
It's about making the attacker's job harder while making your own job easier.
Digital Drive IT Solutions
Demystifying technology so people can make better decisions.