How to Choose a Strong Password: Entropy, Passphrases and What Actually Protects You

What strength actually means: entropy

A password's strength is the number of equally likely possibilities an attacker has to work through, usually expressed in bits of entropy. If a password is drawn at random from a set of C characters and is L characters long, there are C^L possibilities, and the entropy is L × log2(C) bits. Each extra bit doubles the work.

The critical word is random. Entropy measures the process that produced the password, not the characters on screen. 'Tr0ub4dor&3' looks like 11 characters from a 94-character set, but it was produced by taking one dictionary word and applying predictable substitutions — a cracking tool reaches it in a tiny fraction of the time the raw character count suggests.

The table below assumes a true random draw and an attacker who has stolen a password database and can test 100 billion guesses a second offline — roughly a serious GPU rig against a fast, poorly chosen hash. That is the worst realistic case; against a properly slow hash such as bcrypt or Argon2, every figure gets vastly longer.

Length beats complexity, and it is not close

Read the table column by column and the lesson is obvious. Going from 8 to 12 characters on the same keyboard set multiplies the work by 78 million. Going from lowercase-only to the full 94-character set at the same length multiplies it by about 30,000. Four extra characters are worth far more than any amount of punctuation.

This is why a passphrase works. Six words picked at random from a 7,776-word list — the Diceware approach — gives 77.5 bits, effectively the same as a 12-character random string, but you can actually hold it in your head. The catch is the same one as before: the words must be chosen by dice or software, not by you. A phrase you composed yourself from song lyrics or a favourite quote carries a fraction of that entropy, because the attacker's word list is drawn from the same culture yours is.

Aim for at least 12 random characters, or six random words, for anything that matters. For the small number of passwords you must type from memory — your device login and your password manager's master password — a six-word passphrase is the better trade.

The old rules the standards have dropped

NIST's digital identity guidelines (SP 800-63B), which most corporate password policies eventually copy, reversed several long-standing rules once the evidence came in. If your IT policy still enforces them, it is working from an older edition.

• Composition rules are out. Requiring an uppercase, a digit and a symbol pushes everyone to the same predictable pattern — capital at the front, digit and symbol at the end — which narrows the search space instead of widening it.
• Scheduled expiry is out. Forcing a change every 90 days makes people iterate (Summer2024!, Summer2025!) rather than invent. Change a password when there is evidence of compromise, not on a calendar.
• Password hints and knowledge-based 'security questions' are out. Your mother's maiden name, your first school and your birthplace are public or guessable, and in Malaysia several of them are inferable from a leaked MyKad number.
• Minimum length is in — at least 8 characters, and systems must accept at least 64 and all printable characters, including spaces, so passphrases are usable.
• Breach screening is in. New passwords should be checked against lists of previously exposed credentials and rejected if they appear, no matter how complex they look.
• Blocking paste is out. It breaks password managers, which is the single habit that most improves real-world security.

Brute force is rarely how accounts are actually lost

Picking a strong password defends against one attack: guessing. Most compromised accounts are not guessed at all.

The common route is reuse. A site with weak security is breached, your email address and password end up in a dump, and automated tools replay that pair against hundreds of banks, wallets and mail providers — credential stuffing. A 20-character random password is worthless the moment it is used in two places. This is the real reason to use a password manager: not memory, but the ability to give every site a different secret so one breach stays contained.

The second route is phishing. A page that looks like your bank collects whatever you type, and password strength is irrelevant because you handed it over. The defence is where you start from: open the bank's app or a bookmark you saved yourself, never a link from an SMS, WhatsApp message or search ad.

You can check whether an address of yours has appeared in a known breach at haveibeenpwned.com. If it has, change that password and anywhere you reused it — the dump is permanent and already circulating.

Second factors, and why not all of them are equal

Two-factor authentication means a stolen password alone is not enough. The factors are not equally strong, and it is worth moving up the list where a service offers it.

• SMS one-time codes — better than nothing, but vulnerable to SIM swap, malware that reads notifications, and anyone who persuades you to read the code aloud. Malaysian banks have been migrating away from SMS TAC to in-app approval for this reason.
• Authenticator apps (TOTP) — the six-digit rolling code generated on your device. No SMS to intercept, and it works offline. Save the recovery codes somewhere you can reach if you lose the phone.
• In-app push approval — your bank's own app asking you to approve a transaction it describes. Read what is on the screen before approving; approving blind is how people confirm a transfer they did not start.
• Hardware keys and passkeys — a cryptographic key bound to the real site's domain. These are the only factors that are phishing-resistant by design, because the key simply will not respond to a lookalike domain. Where a service offers a passkey, take it.

The Malaysian scam layer

Local scam losses almost never involve a cracked password. The pattern is an approach on WhatsApp or Telegram — a fake parcel notice, a 'wrong transfer' to be refunded, a part-time job doing product reviews, a police or LHDN officer claiming your account is implicated — that ends with you either installing an APK file sent outside the Play Store or reading out a code.

Three rules cover most of it. No bank, telco, police officer or tax officer will ever ask for your TAC, OTP or password; anyone who does is running a scam, with no exceptions. Never install an Android app from a link rather than the official store, because a malicious APK can read your SMS and your screen, which defeats SMS and in-app codes alike. And before you pay a stranger or a new supplier, check the account number and phone number on the PDRM's Semak Mule portal (semakmule.rmp.gov.my), which lists accounts already reported in scam cases.

If money has already moved, speed matters more than anything else. Call the National Scam Response Centre on 997, which can work with the banks to freeze a receiving account, and lodge a police report. Funds are sometimes recoverable in the first hours and very rarely after that.

A setup that works

• Install a password manager and let it generate a different random password for every account. The only ones you need to remember are the master password and your device login.
• Make those two a six-word random passphrase each, generated rather than invented, and write the master one on paper kept somewhere physically safe until it is memorised.
• Turn on 2FA everywhere it is offered, preferring a passkey, then an authenticator app, then SMS. Store the recovery codes in the password manager — or on paper, if they are for the manager itself.
• Protect your email account hardest of all. It is the reset route into everything else, so it deserves your strongest password and your strongest second factor.
• Check your main addresses on haveibeenpwned.com once, fix anything it finds, and stop reusing passwords from that point on.
• Keep the phone and browser updated. Most malware that steals saved credentials arrives through a vulnerability that was patched months earlier.

Important caveats

The cracking times above are illustrative. They assume a specific attacker speed against a specific class of hash, and real figures depend on how the service stored your password — something you cannot see from outside. Treat the ordering as the point: the gaps between the rows are what matter, not the absolute numbers.

This is general security information, not advice on a particular incident. If you believe an account or a bank account has been compromised, contact the institution directly using a number from its official app or website, and report it — do not rely on a guide.

The generator below runs entirely in your browser using the Web Crypto random source. Nothing you generate is transmitted or stored anywhere, but a password shown on screen is only as safe as the device showing it — generate on a machine you trust.