At least 12 characters. Length beats complexity because each extra character multiplies the search space.

* Entropy grows linearly with length — length outpaces a bigger charset. *

The math:

• An 8-character password from a 70-char alphabet → 70⁸ ≈ 5.8 × 10¹⁴ combinations
• A 12-character password from the same set → 70¹² ≈ 1.4 × 10²² — about 24 million times larger
• A high-end GPU around 2026 can do on the order of ~100 billion NTLM hashes/second — so the 8-char space falls in ~1 hour, but the 12-char space takes ~4,500 years at the same rate

Why length wins:

Adding one character multiplies the search space by the alphabet size (~70). Adding one type of character (e.g. symbols) only widens the alphabet a bit. So correcthorsebatterystaple (25 lowercase chars) is vastly stronger than Tr0ub4dor&3 (11 chars with all the "complexity").

Visualizer: https://www.security.org/how-secure-is-my-password/ — try comparing 8-char complex vs 16-char passphrase.

Tip: Famous XKCD on this — https://xkcd.com/936/.

Go deeper:

• NIST SP 800-63B §5.1.1 — Memorized Secrets — the standards body that mandates length, drops arbitrary complexity rules, and requires breach-list checks.

Random words strung together create huge entropy through length, and they're easy to remember by building a story.

The trick:

A dictionary attack tries single words. To attack a passphrase, the attacker must try combinations of words — and the math explodes:

• 5 random words from a 10,000-word dictionary → 10,000⁵ = 10²⁰ combinations
• That's about 100 billion times harder than brute-forcing 8 random characters

Why it's memorable:

The brain remembers stories far better than random strings. Picture the moon (Mond) reflecting on a car (Auto) parked at the beach (Strand)… your hippocampus loves that stuff, your working memory does not love xK7$qPm9!Lz#.

The catch:

The words must be truly random — not a quote from a song, book, or movie. Attackers have specialized wordlists built from lyrics, poetry, and common phrases.

Tool: https://www.eff.org/dice — EFF's diceware wordlists are the gold standard.

Go deeper:

• Password strength (Wikipedia) — the entropy math behind why long multi-word passphrases beat short complex strings.