Why Your Password Length Is the Only Rule That Matters

You've been lied to about passwords. For years, we've been told that a good password needs a capital letter, a number, a symbol, and a mandatory update every 90 days. That advice is not just outdated—it's counterproductive. What actually stops attackers is not complexity; it's length. The single best move you can make for password security is to use long, random passphrases—16 characters or more—stored in a password manager. Let me show you why.

The Misconception: Complexity Over Length

I've seen the old rules drilled into employees and friends alike: mix in a $, replace an 'o' with a zero, change it every quarter. But the National Institute of Standards and Technology (NIST), the US federal agency that sets digital identity guidelines, has explicitly rejected forced complexity and mandatory periodic changes. In their SP 800-63B guidelines, NIST forbids requiring special characters and forces password expiration—because those rules push people into predictable patterns like "Password1!" or "Summer2024!". The result is weaker security, not stronger.

What does NIST actually require? When a password is the only authentication factor, it must be at least 15 characters long. It also says to allow up to 64 characters, including spaces and Unicode. That's a radically different mindset: instead of forcing you to contort a short string into something "complex," it asks you to make it long. And the UK's National Cyber Security Centre (NCSC) has landed on the same idea with its "Three Random Words" advice—build passwords from three unrelated words (like 'applenemobiro') so they're long enough and strong enough yet easy to remember. The NCSC warns that letter-to-symbol swaps, like changing 'o' to '0', add little strength. They're decorations, not defenses.

The Math of Cracking: Why Length Wins

Let me make this concrete. Attackers don't guess your password one character at a time like a movie hacker. They use software that tries millions of combinations per second, starting with common passwords and dictionary words. A short password—even one with symbols—falls quickly. A long password, on the other hand, exponentially increases the search space. Every additional character multiplies the possibilities. That's why CISA, the US Cybersecurity and Infrastructure Security Agency, recommends passwords of at least 16 characters and says "longer is stronger." They even suggest passphrases made of four to seven unrelated words, which may include spaces. That's not just a suggestion; it's grounded in the reality of how password cracking works.

Consider a real scenario: you have a 10-character password like "Tr0ub4dor!"—complex but short. A cracking rig can run through that space in a matter of days. Now imagine a 20-character passphrase: "correct horse battery staple" (yes, spaces count). Even if an attacker knows you're using words, the combinations are astronomically larger. The NSA and CISA jointly identified "poor credential hygiene," including easily crackable passwords shorter than 15 characters, as one of the top ten most common network misconfigurations. That's not a niche opinion—it's a national security advisory.

The Real Enemy: Reuse and Breaches

But length alone isn't enough if you reuse that same long password everywhere. Microsoft, in their security research, notes that password reuse enables password-spray and credential-stuffing attacks, where attackers take common or previously breached passwords and try them against corporate accounts. And breaches are everywhere. Have I Been Pwned, a free service run since 2013 by Troy Hunt, lets you check if your email has appeared in a known data breach. It was created after the Adobe breach—at the time the largest single breach of customer accounts—because the same accounts kept appearing exposed, often with the same passwords. That's the core problem: you can't control whether a company you trust gets hacked, but you can control the damage by using a unique password for every account.

So the answer is not just length—it's unique length. That's where a password manager comes in. CISA advises using a password manager to generate and store random, unique passwords for every account, eliminating password reuse. The NCSC also recommends password managers. A password manager can create a 20-character random string for each site and remember it for you. You only need to remember one master passphrase—which should be long and memorable, like three random words. That's the practical path.

What About MFA? Don't Skip It, but Don't Rely on It Alone

Now, some might say, "Why bother with long passwords when I have multi-factor authentication (MFA)?" MFA is powerful—Microsoft states that enabling MFA can block over 99.9 percent of account compromise attacks. That's a staggering number. But MFA is not a silver bullet, and CISA documents four ways traditional MFA is bypassed: phishing, push bombing (push fatigue), exploitation of SS7 protocol vulnerabilities, and SIM swapping. So even with MFA, a weak password can still be a foothold.

Here's the thing: MFA and long passwords are not either/or. They work together. If you have a long, unique password and MFA, an attacker who steals your password still can't get in without your second factor. And if they try to bypass MFA, they still need the password. But if you have a short, reused password, MFA might be your only defense—and that defense can be phished. CISA recommends phishing-resistant MFA like hardware security keys or passkeys, but until that's everywhere, the baseline is a strong password.

Let me give you a concrete example. Suppose you use the same 12-character password for your email and your bank. A breach at a shopping site exposes that password. An attacker now has your email password and can try it at your bank—credential stuffing. If you had used a unique 20-character passphrase for each, the breach at the shopping site is a non-event. That's the difference.

Bottom Line

Forget complexity and expiration. The single best move you can make is to use a password manager to generate and store a unique, random password of at least 16 characters for every account—and enable MFA where available. Length is the foundation; uniqueness is the walls. Do that, and you've done more for your security than a decade of forced resets ever could.

Sources

• NIST SP 800-63B (Digital Identity Guidelines) - https://pages.nist.gov/800-63-4/sp800-63b.html
• CISA (Use Strong Passwords) - https://www.cisa.gov/secure-our-world/use-strong-passwords
• NCSC (Three Random Words) - https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words
• Microsoft Security Blog (MFA) - https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/
• Have I Been Pwned (About) - https://haveibeenpwned.com/About