Stop Fighting Your Password Rules — Switch to a Passphrase Instead
If you've ever been forced to create a password with an uppercase letter, a number, a symbol, and no dictionary words — and then promptly forgot it five minutes later — you're not alone. You're also not the problem. The rules were. For about two decades, "password complexity" rules were the standard advice: mix your cases, throw in a digit, add a special character, and never reuse the same word twice. It sounded reasonable. In practice, it backfired badly.
Why the old rules failed
Human memory isn't built to hold onto random strings like
qX7!vB2#
So when systems forced people into that mold, most people didn't actually generate randomness — they generated patterns.
Password1!
Summer2023!
Capitalize the first letter, tack a
1
and a
!
on the end, call it a day. Security researchers have known for years that these substitutions are so predictable that cracking software checks for them by default. The complexity requirement didn't make passwords harder to guess — it just made them harder to remember, while barely touching how easy they were to crack.
And because remembering one of these was already painful, most people reused the same one or two across dozens of accounts. That's arguably the single biggest security failure of the whole approach: crack — or simply leak — one site's password database, and suddenly the attacker has the keys to that person's email, banking, and everything else tied to the same reused password.
If this describes you, don't feel bad about it. It describes nearly everyone. The system asked humans to behave like random number generators, and humans, predictably, didn't.
Why length beats complexity
Here's the part that doesn't get explained often enough: the difficulty of cracking a password grows exponentially with its length, far more than it grows from adding symbol requirements to a short one.
Think of it in terms of how many guesses an attacker's computer has to try. Every additional character multiplies the number of possible combinations. An 8-character password pulled from a decent character set might take a modern cracking rig hours to days to brute-force. A 20-character passphrase — even one made entirely of ordinary lowercase words — can push that same brute-force attack into the realm of centuries, simply because of how much longer the string is and how many possible combinations that length creates.
Complexity rules were trying to buy security by widening the character set at each position. Length buys security by adding more positions — and it turns out that's a far better trade, because it doesn't fight against how memory actually works.
Where passphrases come in
A passphrase is just a string of several unrelated words — something like
horse battery correct staple
or
maple ledger thunder pocket
It's long (which is what makes it hard to crack), but it's built out of words your brain already knows how to store, which is what makes it easy to remember.
The key word there is unrelated. A passphrase drawn from a common saying, song lyric, or movie quote doesn't get the same benefit — attackers maintain huge lists of exactly those phrases, and "the early bird catches the worm" is not meaningfully more secure than "password123" once it's on a cracking list. The strength comes from combining words that don't belong together in any predictable way, so there's no shortcut for a guessing algorithm to lean on.
The tradeoff people worry about — "but that's so much more to type!" — is much smaller than it sounds, and for most day-to-day use it's a non-issue: browsers and password managers save and autofill your passphrase after the first entry, so you're rarely typing the whole thing out by hand anyway. The extra length costs you almost nothing in daily friction, but it costs an attacker enormously more in computing time.
The bottom line
Complexity rules (mixed case, digits, symbols) mostly just made passwords hard for humans, not for machines.
Those rules pushed people toward predictable patterns and password reuse — arguably making things worse.
Length is the real lever for security, and it scales exponentially.
A passphrase of several unrelated, ordinary words is both easier to remember and harder to crack than a short cryptic password.
Autofill means the "it's more to type" objection barely applies in practice.
If you've been using something short and simple across multiple accounts because complex passwords were unmanageable, you're not being careless — you were handed an approach that didn't work for how people actually think. Switching to long, unrelated-word passphrases isn't a step backward in convenience. It's arguably the first password advice in years that respects both your memory and your security at the same time.
Password Generator