How Strong Is Your Password, Really?

Most people judge a password by how annoying it is to type. If it has a capital letter, a couple of numbers, and a symbol crammed in somewhere, it feels safe. The trouble is that attackers do not experience your password the way you do, and the tricks that make a password irritating to humans barely slow a computer down.

Password strength is not a vibe. It comes down to one question: how many guesses would it take to land on yours? Answer that honestly and most of the old rules fall apart, while a much simpler approach turns out to be far stronger.

How passwords actually get cracked

The Hollywood image of an attacker brute-forcing every possible combination one by one is mostly a myth. Against a genuinely random string, brute force is hopeless, and attackers know it. So they do not start there. They start with what humans predictably do.

• Leaked password lists. Billions of real passwords have spilled out of past breaches. Attackers try those first, because a shocking number of people reuse them.
• Dictionaries and wordlists. Real words, names, sports teams, and pop culture, plus the common ways people decorate them.
• Rule-based mangling. Cracking tools automatically capitalize the first letter, append a year, swap "a" for "@" and "o" for "0", and tack "!" on the end, because that is what people do.

In other words, the attacker's software already knows your clever substitution before you thought of it. That is the whole problem with "P@ssw0rd!". Every transformation in it is a default rule in the tools built to guess it.

Why length and unpredictability win

Strength is really about the size of the haystack. Each additional character multiplies the number of possibilities an attacker would have to search, and length adds those multiplications far faster than swapping one letter for a symbol. A short password dressed up with symbols is a small haystack that merely looks messy. A long, unpredictable password is a genuinely enormous one.

The catch is that length only helps if the content is unpredictable. "Password123456789" is long and still worthless, because it is a known word followed by an obvious sequence. What you want is length plus randomness: characters, or words, that follow no pattern a wordlist or rule can anticipate.

A password is only as strong as it is unpredictable. If a guessing tool can reach it with common rules, its length on paper does not matter.

Two ways to build a genuinely strong one

There are two approaches that hold up, and you do not have to choose between them account by account.

1. A long random string

Something like a 16-character or longer jumble of letters, numbers, and symbols with no words in it. It is unguessable and impossible to memorize, which is fine, because you should not be memorizing per-site passwords at all.

2. A random passphrase

Several unrelated words chosen at random, like "otter-canyon-ledger-thistle". This gets its strength from length and from the words being picked randomly, not from meaning. It is easier to type on the rare occasion you must, and still enormous to guess. The key word is random: a phrase you made up from a song lyric is not, because it sits in a wordlist.

Let a generator do it, and a vault remember it

Here is the honest truth: no human can invent and recall dozens of long, random, unique passwords. That is exactly the job a password manager exists to do. A built-in generator produces a fresh, high-strength password for each account, and the vault stores it so you never have to type or remember it. Your only job is to keep the vault safe.

Kinship Vault includes a password generator for long, unique passwords, and its Security Checkup scores each of your logins out of 100 and flags the weak ones, along with reused and old passwords, so you can see at a glance which accounts still rely on something guessable. The checks that matter run on your device, and you can generate as you go from the generator.

The short version

Stop grading passwords by how many symbols they contain. Grade them by how unpredictable and how long they are, and by whether you have used them anywhere else. Let a generator make them, let a vault remember them, and let a health check tell you which old ones to replace. That is the whole game.