Most passwords are created one of two ways
Using a password that you make up that is easy to remember can probably be guessed by a computer in less than one second.
Using a password that is made for you from random letters can take years for a computer to guess, but is likely to be impossible to remember, especially if you have a different one for each web site.
You already know that the more characters in a password, the harder it is to guess. And you know that with upper and lower case, and numbers and special characters its much harder to guess. But you might not realise that the different characters in each position has a greater impact on the password difficulty than does the number of characters. This is because the number of combinations is exponential with the number of combinations raised to the power of the number of possible values.
There are 26 letters in the english alphabet, 10 numbers, and about 10 useable special characters, if you use upper and lower case, the total number of possible values in a single position is 72. A 12 character password, with 72 possible values has 12^72 combinations, or 1.9x10^22. That's 19 followed by 21 zeroes.
The worlds fastest computer, as of January of 2025, is El Capitan, it achieved 2.7x10^18 FLOPS per second. So no computer can try more than that many combinations per second.
If a computer could generate a 12-character password and test it in a single FLOP, then it could go through all the possible combinations in 118 minutes. A 16 character password would take 6000 years, 20 characters in 1.6x10^11 years, and 32 characters in 3.1x10^33 years.
But remembering a 16 character password is extremely difficult, remembering several of them is impossible for most people.
Words, though, are not limited to 72 per position. According to chatGPT, as of 22nd of January 2025, the English language has about 390,000 words of 4 to 8 characters in length. We can add 60,000 or more words from every other language, like French, Spanish, or German, and when we add first and last names it's literally in the millions. ChatGPT said between 10 and 20 million last names alone. But for this calculation, I'm using 390K English words, 60K French, 60K Spanish, and 60K German words, plus 150k first names and 150k last names, for a total of 960k possible words/names. If we add dates and phone numbers, obviously we go over 1 million possible values for a single "word".
Using five words, it would take that fastest possible computer 11,500 years, six words would be 1x10^10 years (10 billion years), seven words would be 1x10^16 (10 quadrillion), and eight words would take 1x10^22 years (10 sextillion).
With this information, five words are better than a 16 character password.
Note: if we asked you for specific classifications of words for each position, this number goes way down, but that's not a restriction, you can use any combination of "words" in whatever sequence you desire.
