Update (2026): This article is from 2017, and password guidance has changed since then. Current recommendations (for example NIST SP 800-63B and Germany’s BSI) favour length over complexity: use a passphrase of at least 15 characters or a long random password, ... Continue Reading →