GUIDE深度 · Deep dive
Password Length vs Complexity
Password strength is roughly length times log2 of the character-set size. Adding length usually beats forcing symbols, and aligns with NIST: prioritize length and uniqueness over composition rules.
Estimating entropy
Twenty characters from a 62-character set is about 20 times log2(62), roughly 119 bits; eight characters is only about 48.
Entropy is an estimate; actual risk depends on randomness, reuse and breaches.
Why not force symbols
Forced symbols lead to predictable substitutions such as a to @ or o to 0, reducing real strength.
Long random passwords with a manager and 2FA are more practical than mandatory symbol rules.
FAQ
Is 80 bits enough?
Enough for most online accounts; use 100+ bits for important ones.
Are symbols useless?
No; they enlarge the set, but not at the cost of length.