The strength of a password is determined by its scheme. A code like
aaaaaaaaaa must be assumed to have a scheme of "ten letters" and is therefore trivially cracked compared to the scheme we must assume from
Attackers prioritize the simplest arrangement that meets the password scheme: start with a capital letter, end with a number and then punctuation, fill the middle with the minimum lowercase letters, starting with words as sorted by frequency. I have such a dictionary, so I could start with
Zzzombie9~, then progress to the non-word combinations of
Zzzzzzzz9~ before different variations.
Ensuring your password is more complex than the minimally permissible code gives you a slight advantage;
#aaaaaaaaa should take a few minutes longer to crack as
#^Afx375Zq will take a good amount longer because it mixes four classes of characters and only uses three lowercase letters.
Always assume attackers know your scheme. You may get lucky and be able to hide behind some obscurity, which is certainly worthwhile, but it must not factor into your math. Don't try to be "clever"—Kaspersky's attempt at this ended in failure; they made assumptions about the attack order that ended up creating much weaker passwords.
Forcing users to add complexity to the characters in their passwords forces attackers to increase the complexity of their brute-force attacks, though it actually weakens the overall entropy. It prevents lazy and easily-guessed passwords like
aaaaaaaaaa by removing them from the possible password list. There are 94⁸ possible eight-character passwords (60 quintillion, entropy = 52), yet requiring a lower, upper, number, and special reduce that to 26×26×10×32×94⁴ (16 trillion, entropy = 43).
I like Beatles' songs. is neither random nor unique. Unsurprisingly, Google has hits for it.
👉 If a Google query for your password (quoted & de-0bfuscated) might get hits, it is weak.
Passwords must actually be random (not arbitrary! not obscure! a pseudorandom number generator is okay), by characters (for passcodes) or by words (for passphrases).
I like Beatles' pants. is more unique, but it's arbitrary, not random. You cannot "make up" a random phrase without assistance (ideally using a generator), only one that seems random. It's okay to generate several phrases and pick one that you can make a creative story around.
I calculated a word is worth 2.5 characters, so for equivalent entropy to a passcode with 10 random characters, log₂(94¹⁰) = 65, you'd need a passphrase with 4 random words, log₂(100000⁴) = 66. That's on the weaker side, and again: a passphrase that is a sentence is not secure.
Length isn't everything. Don't be fooled by the impressive length of a passphrase. Sure, your musical preference is 21 characters, but even if we assume it's random and not known to Google, it's four words with some punctuation thrown in: log₂(100000⁴×32²) = 76. Compare that to random lowercase letters: log₂(26²¹) = 98. Compare those to random characters: log₂(94²¹) = 137.
A summary of my password advice:
The world has gotten sophisticated enough that it's impossible to remember your fully-random and unique-per-account passwords (be they codes or phrases).
- Use authenticator apps for 2FA or passwordless access when available
- Use a password manager to generate and save passwords
- Lock your password manager with a strong password with 90+ bits of entropy,
say with a generated 4char code randomly placed within a generated 4word phrase,
entropy = log₂(100000⁴×94⁴×5) = 94, like
junkie unknotted 7!cT opposite litter.
Make a story to remember the words and keep the 4char code in your wallet if needed.