For years, password advice pushed complexity — mix in a symbol, a number, a capital letter. Modern security guidance, including from NIST, has shifted toward emphasizing length instead, and the math behind that shift is straightforward.

The math behind length

Every additional character in a password multiplies the total number of possible combinations, while adding a new character type (like requiring one symbol) only adds a small, predictable set of extra options that attackers already account for in their cracking tools.

A rough comparison

• An 8-character complex password can be cracked far faster than most people assume with modern hardware
• A 16-character password made of random words, even without symbols, takes dramatically longer to brute-force

The practical takeaway

Longer passwords, generated randomly rather than based on personal information, remain the strongest defense. Use a password generator to create a long, random string rather than trying to memorize a short one padded with a single symbol and number swap.