How many choices did the person making this password really make?
A password can look complicated while following a very simple recipe. A season, a year and an exclamation mark produce many characters but relatively few surprises. Conversely, a sequence of independently selected words can be readable without being a sentence anyone would naturally write. The useful question concerns the selection process, not the decoration on the finished string.
Count the choices, not the punctuation.
A space is a set of possibilities
Imagine twelve positions, each filled by an independent, equally likely choice from twenty-six lowercase letters. There are twenty-six possibilities for the first position, another twenty-six for the second, and so on. Multiplication gives 26 to the twelfth possible strings. This is a mathematical model of a generator, not a judgment about a person’s existing password.
If the choice is instead a favorite twelve-letter word, the alphabet calculation no longer describes how it was selected. Human preferences concentrate probability on a smaller set of recognizable patterns. Adding a predictable suffix does not make those preferences disappear. A length meter can measure characters accurately while missing the most important fact about their origin.
Four more random letters make a measurable difference
Our offline calculation compares twelve random lowercase letters, sixteen random lowercase letters, and six independent words chosen uniformly from a list of 7,776 entries. The first two spaces contain about 56.4 and 75.2 bits of choice. Six words provide about 77.5 bits under the stated assumptions. Bits here mean the base-two logarithm of the number of possibilities.
Adding four letters multiplies the first space by 456,976. That ratio is exact; it does not predict how long an attacker needs. Guessing speed depends on the service, rate limits, password storage, available hardware and what information is already known. We did not run guessing software, inspect leaked material or test anybody’s account.
A quotation does not become random by being long
Six words remembered from a film are selected through a different process from six independent draws. Their order may already be familiar to many people. Personal facts, common substitutions and repeated patterns create similar problems. The calculation is useful precisely because it makes the assumptions visible rather than awarding every long sentence the same impressive number.
A password manager can create and keep unique passwords without requiring you to invent a memorable story for each account. For a password you must remember, a reputable random-word method can be appropriate. Keep its output private and do not reuse an example from an article. This piece deliberately supplies no password to copy.
Uniqueness solves a different problem
Even a strong randomly generated password loses an important protection when it is used on several services. If one service exposes it, its unpredictability no longer helps against someone who already knows the exact string. Unique passwords contain that particular form of spillover. They do not remove dependencies created by shared recovery email accounts or existing signed-in sessions.
For everyday priorities, protect the password manager and main recovery email especially carefully. Use available stronger sign-in protection, keep recovery options usable, and make a plan for losing your usual device. The best theoretical string is not a complete account plan if its owner cannot recover access or distinguish a genuine login page from a convincing imitation.
Read the number with its assumptions attached
The word-list model permits repeated words because each draw is independent. Banning repetitions changes the counting rule slightly; choosing words for a pleasing rhythm changes it much more. We also do not assume that every service accepts spaces, long inputs or every character. Follow the service’s supported limits without treating arbitrary complexity rules as a substitute for good selection.
If you want one practical improvement today, start with a reused account password and replace it with a unique generated one through the genuine service. Store it safely and confirm that recovery still works. You need not calculate logarithms each time. The calculation teaches why an unpredictable process and a manageable habit belong together.
Further reading
NIST: Password guidance ↗CISA: Use strong passwords ↗Original documentation and useful background.