Why a Long Password Beats a Complicated One

The xkcd comic that changed how we think about passwords — and how to use it today

Fun fact

In August 2011, Randall Munroe's webcomic xkcd published comic #936, “Password Strength,” and quietly rewired a decade of security advice. It compared “Tr0ub4dor&3” — a typically mangled password with about 28 bits of entropy, crackable in roughly 3 days at 1,000 guesses per second — with “correct horse battery staple”, four random words carrying about 44 bits, which would take some 550 years at the same speed. The punchline: the “hard” password is hard for humans to remember, while the word chain is easy to memorize and mathematically far stronger. The advice stuck. In 2017, NIST's Special Publication 800-63B officially dropped the old composition rules (mandatory symbols, frequent forced changes) in favor of long, memorable passphrases.

Tool usage guide

  1. Open the Password Generator on simpytool.com.
  2. Slide the length to 16+ characters — or pick the passphrase mode with 4–5 random words.
  3. Enable uppercase, digits and symbols if the site allows them.
  4. Check the strength meter; aim for “very strong” before copying.
  5. Copy the result into your password manager — never reuse it on another site.

Try the tool

Password Generator →

Further reading

Password strength (Wikipedia) — Wikipedia article