Notes: In the language of computational complexity, the number p of passwords of length L in a character space of size c is given by p(c, L) = c^L. If we fix L, then p is a polynomial function in c, and if we fix c, then p is exponential in L.

Therefore, it's more important to choose a longer password or phrase than it is to use a larger character set, other things being equal. As a practical matter, however, it's wise to do both.

Increasing the length of your password or pass phrase by even one character can greatly increase its security. In any fixed character space, there are many more passwords of length n + 1 than there are passwords of lengths n or fewer.

For example, suppose a password of length 10 is chosen from the upper and lower characters and the digits. The character space is 62 and the total number of possible passwords is 62¹⁰ or about 1.45 E17. Increasing the length of the password to 11 characters yields about 7.52 E18 possibilities. One would need to increase the number of characters in the character space from 62 to 73 to achieve a comparable increase in possible passwords of length 10.

Taking another example, suppose you've chosen a password with 8 characters, all of them lowercase. If you double the number of possible characters by including upper as well as lowercase characters, then you've increased the total number of possible passwords from 26⁸ to 52⁸ = (2⁸)(26⁸) = 256×26⁸, or by a factor of 256.

That is, there are 256 possible passwords in the larger character space than there were in the smaller space. Think of it as follows: the first character in the password can be upper or lower, so there are 2 choices in that place. The second character can also be upper or lower, again 2 choices, and so on eight times, for a product of 256 different passwords using both upper and lower for each password using all lowercase.

If, however, you double the length of your password from 8 characters to 16 characters, while sticking with lowercase letters only, then the total number of possible passwords increases from 26⁸ to 26¹⁶ = (26⁸)(26⁸), or by a factor of about 200 million. That is, there are 200 million different passwords of length 16 for each password of length 8.

Each 16-character pass phrase can be thought of as two 8-character passwords stuck together. For each of the 200 million or so 8-character passwords in the first 8 places, there are another 200 million possible 8-character passwords in the last 8 places. Given that the last 8 characters are chosen independently of the first 8 characters, the resulting number of passwords is the product of 26⁸ and 26⁸.

The fancy understanding of this is that the total number of possible passwords increases in polynomial time (c²) with a doubling of the number of characters in the available character space, but it increases in exponential time (in this case 26^L) with an increase in the length of the pass phrase.