Password strength is mathematically quantified by 'entropy', which measures the unpredictability of a password in bits. In information theory, one bit of entropy represents a pool of possibilities that is doubled. A password with 50 bits of entropy requires, on average, 2^(50-1) guesses to crack.
The formula for password entropy is: E = L × log2(R), where 'L' is the length of the password and 'R' is the size of the character pool. If you use lowercase letters (26), uppercase letters (26), numbers (10), and 32 symbols, your pool size 'R' is 94 characters.
Length vs Complexity
Many people focus on complexity (adding symbols and numbers) rather than length, but the math favors length exponentially. An 8-character password using all 94 possible characters has an entropy of 8 × log2(94) ≈ 8 × 6.55 = 52.4 bits. It has 94^8 possible combinations (about 6 quadrillion).
Compare that to a 16-character password using only lowercase letters (R=26). Its entropy is 16 × log2(26) ≈ 16 × 4.7 = 75.2 bits. It has 26^16 possible combinations (about 43 billion billion). Despite having no special characters or numbers, the 16-character lowercase password is exponentially stronger against brute-force attacks.
The reality of brute-force times
Modern password cracking uses specialized GPU clusters capable of attempting billions of hashes per second. If an attacker can guess at 100 billion hashes per second, an 8-character complex password (52 bits) can be exhausted in less than a day.
Every additional bit of entropy doubles the time required to crack the password. Moving from 52 bits to 75 bits of entropy doesn't increase the cracking time by 50%; it increases it by a factor of 2^23 (over 8 million times). A 75-bit password would take thousands of years to crack at the same speed.