Why a long password beats a complicated one

Websites tell you to add a capital, a number and a symbol. But length does far more for a password than funny characters ever can.

Count the possibilities and you'll see why: 8 characters using the whole keyboard can be brute-forced in about a week at 10 billion guesses a second, while 16 plain lowercase letters would take over 100,000 years. Play with a calculator, test made-up passwords in a pattern checker that runs entirely in your browser, and learn why P@ssw0rd! falls instantly, how passphrases work, and why you should never reuse a password.