Why You Should Swap Passwords for Passphrases

[Passages]

Oct 22, 2025
The Hacker News


The advice didn't change for decades: use complex passwords with uppercase, lowercase, numbers, and symbols. The idea is to make passwords harder for hackers to crack via brute force methods. But more recent guidance shows our focus should be on password length, rather than complexity. Length is the more important security factor, and passphrases are the simplest way to get your users to create (and remember!) longer passwords.

The math that matters#
When attackers steal password hashes from a breach, they brute-force by hashing millions of guesses per second until something matches. The time this takes depends on one thing: how many possible combinations exist.

A traditional 8-character "complex" password (P@ssw0rd!) offers roughly 218 trillion combinations. Sounds impressive until you realize modern GPU setups can test those combinations in months, not years. Increase that to 16 characters using only lowercase letters, and you're looking at 26^16 combinations, billions of times harder to crack.

This is effective entropy: the actual randomness an attacker must work through. Three or four random common words strung together ("carpet-static-pretzel-invoke&quot deliver far more entropy than cramming symbols into short strings. And users can actually remember them.

https://thehackernews.com/2025/10/why-you-should-swap-passwords-for.html?_m=3n%2e009a%2e3805%2eqb0ao44uux%2e2ue2