Why “strong” passwords still fail (and what to do instead)

By Tomer Bar, Semperis, Associate VP of Security Research

We’ve been using passwords to prove who we are since the very first multiuser computers. Decades later, they’re still with us—and still causing trouble. Passwords have a terrible reputation, but that’s not really the password’s fault. It’s ours. Most of the risk comes from human limitations and predictable behaviour, not from the mathematics behind “guessing every possible combination”.

Concept artwork generated by Google Gemini on the topic of rainbow tables. This image might be factually inaccurate.

Let’s look at why “strong” passwords can be weaker than you think, what advanced attackers do and how to choose passwords that are hard to crack.

The comforting myth is that a 10-character password using upper and lowercase letters, numbers, special characters must be secure simply because its theoretical number of combinations is enormous.

The total search space is in the order of tens of quintillions of combinations (around 5.4×10¹⁹). Even if an attacker can test 1 billion guesses per second, it would take roughly 1,700 years to exhaust the entire space with a pure brute-force attack. That may look reassuring on paper, but it’s misleading, because very few people actually create truly random 10-character passwords. To remember a password, humans tend to fall back on predictable patterns: a capital letter first, followed by one or more lowercase letters, then 1–4 digits (often a year), and finally a single special character at the end.

Advanced attackers know this. They don’t brute-force the entire key space; they brute-force your habits. If they restrict themselves to “human-style” patterns like the one above, the space can shrink to about 10¹⁴ (100 trillion) possibilities. With a high-end GPU doing 100 billion guesses per second, that entire pattern space can be exhausted in minutes, not centuries.

From a pure brute-force perspective, a random 15-character password from the full character set is essentially uncrackable with current hardware. If it’s random, the math is on your side. But again, we’re back to humans.

When people create long passwords, they often rely on memorable patterns, small variations of old passwords, predictable phrases, or popular lyrics, quotes, and memes rather than random strings. Attackers take advantage of this by using large dictionaries built from leaked password databases and applying rule-based tweaks—such as adding the current year, swapping letters for symbols, or tacking on punctuation—to guess these “memorable” passwords efficiently.

They also build rainbow tables: precomputed tables of password hashes. Because most systems store only hashes, not raw passwords, a rainbow table allows an attacker to reverse a hash back to the original password, if that password is in the table. These tables can be downloaded from public sites. If your 15-character masterpiece is in there—or is a simple rule-based variation of something that is—length won’t save you. It will fall in seconds.

Are passwords useful today? Yes, but they’re no longer enough on their own. Multifactor authentication (MFA) should be enabled wherever possible because it makes stolen or guessed passwords far less valuable.

If you keep using passwords, the best practice is to stop letting humans design them. Use a password manager to generate and store long, truly random passwords (20+ characters) and never reuse them; turn on MFA wherever possible so stolen passwords are far less useful; and for the few passwords you must remember, use long, unique passphrases made of random words instead of lyrics, quotes or clever patterns. The goal isn’t perfect, it’s to make attacking you so difficult and unprofitable that attackers move on to easier targets.