Wordle works because the search space is small enough to be beatable and large enough to be interesting. Five-letter English words number in the low thousands. Six guesses, with feedback after each one, is almost always enough. Good players do not brute force it. They open with a word that maximises information, read the response, and eliminate most of the dictionary in a single move.
That is a fair description of how password guessing actually works, and it explains why a lot of intuitively strong passwords are not.
The dictionary is the point
The naive model of password cracking imagines an attacker trying every possible combination of characters from the beginning. Nobody does this, because it is wildly inefficient against passwords that humans invented.
Human-chosen passwords cluster. They are drawn from words, names, dates, places, sports teams, and pop culture. So the efficient approach is to try the cluster first: dictionary words, then dictionary words with predictable modifications, then combinations of dictionary words. The full character space only becomes relevant for passwords that were never human-chosen in the first place.
This is why the modifications we were all taught do so little. Replacing a letter with a similar-looking digit, capitalising the first character, appending a punctuation mark to satisfy a form validator. These are not creative variations. They are the same transformations everyone applies, which means they are the first ones any guessing tool applies too. A word plus a predictable twist is, for practical purposes, still a word.
It is the Wordle opening move again. If you know how the target was likely constructed, you do not need many guesses.
Which is why the official advice changed
Password rules used to encode exactly the wrong theory. Force a capital, a number, and a symbol, and change it every ninety days.
The updated authentication guidance in NIST Special Publication 800-63B-4 reverses much of this. Composition rules of that kind are discouraged, because they push users toward predictable patterns rather than genuine unpredictability. Mandatory periodic changes are no longer recommended, for the same reason: people iterate rather than reinvent. What the guidance emphasises instead is length, support for long credentials, and screening prospective passwords against lists of values known to be compromised.
That last point is the direct application of the dictionary insight. Rather than trying to legislate creativity, check whether the password already appears in the pile attackers are working from.
Where the word-based approach does and does not hold up
Passphrases built from several unrelated words are genuinely better than a single modified word, and the UK National Cyber Security Centre's three random words guidance recommends the approach for good practical reasons. Multiple words produce a long credential, the method is easy to explain to anyone, and it encourages passwords people have not thought of before.
Two conditions do the work, and both are easy to break.
The words must be genuinely random, which is where people fail. Asked to pick three unrelated words, we pick words that are related to us or to each other, because that is what makes them memorable. A phrase built from your interests is not random, it is a slightly longer clue.
And the words must not form a recognisable phrase. Anything that appears in song lyrics, film titles, or common speech has already been harvested.
The NCSC is notably honest about the ceiling here. Its own analysis of the approach acknowledges that random passwords generated by a password manager are stronger than either three random words or human-generated complex passwords. Three random words is offered as the best method for credentials a person must actually memorise, not as the strongest method available.
That distinction is the useful one. You need one or two memorable credentials. You need dozens of unguessable ones. Those are different problems and they want different tools.
The practical split
For the small number of passwords you genuinely have to type from memory, primarily the one protecting your device and the one protecting your password vault, the multiple-words approach is sound. Choose the words by some genuinely random method rather than by thinking of them, and do not build a phrase that means something.
For everything else, stop generating passwords yourself. A free password manager produces credentials with no linguistic structure for a dictionary attack to exploit, stores them so memorability stops being a constraint, and will tell you which of your existing passwords are reused or already known to be breached. The first scan is usually a humbling experience.
Then add multi-factor authentication on the accounts that matter most, starting with email, since that is the reset path for nearly everything else. CISA's guidance on strong passwords sets out the same combination, and recommends at least 16 characters where the password is being generated for you rather than remembered. A strong password reduces the chance of a successful guess. It does nothing if the password was phished rather than guessed, which is why the second factor is not optional.
The takeaway
The reason Wordle is solvable in six guesses is that the answer comes from a list, and good play is really just efficient list elimination. The reason many passwords fall quickly is identical.
A password that came from a list, in any form, however cleverly modified, inherits the weakness of that list. A password generated at random from a wide character set does not belong to a list at all, which is precisely what makes it uninteresting to guess and, unfortunately, impossible to remember.
Fortunately, remembering it was never the requirement. That is what the vault is for.