Microsoft guidance from 2016 appears to argue that requiring passwords longer than about eight characters may not improve security. That seems counterintuitive, since a genuinely random longer password should take much longer to brute-force. The guidance also discusses blocking passwords that contain certain words. If the complete password is unique, long enough, and absent from known password lists, why should a substring inside it matter? Is the recommendation about password length itself, or about how users respond to rigid password rules?
4 Answers
Online brute force should not be the main comparison because a properly designed service rate-limits or blocks repeated login attempts. However, that does not make length irrelevant: stolen password databases can be attacked offline without the site's login throttling. Also, 'guessing' often means trying likely human choices from dictionaries and personal information, while brute force means systematically trying combinations. A long password made from predictable words can still be easier to guess than a shorter random one.
The important distinction is between encouraging long passwords and imposing rigid length or complexity requirements. Longer, unpredictable passwords are generally better. The concern is that strict rules can cause users to choose predictable patterns, such as repeating a short word until it meets the minimum length, or making a minor variation of an old password. A memorable passphrase or a randomly generated password is usually preferable to an awkward password built around arbitrary rules.
The linked guidance is from 2016 and is not a good representation of current best practice. Modern recommendations generally favor allowing or encouraging long passwords and passphrases, avoiding unnecessary composition rules and periodic expiration, checking passwords against lists of compromised values, and using phishing-resistant multifactor authentication. Password length still matters when an attacker obtains a password hash and can attack it offline.
Blocking words can make sense for passwords that are mostly predictable phrases, common defaults, organization names, usernames, or known breached passwords. It is less useful to reject a strong random password merely because it contains a common substring. Password screening should evaluate the complete password against common and compromised-password data, and it must happen on a trusted system before the password is hashed—not by trying to inspect the stored hash later.
A substring rule can still be an administrative policy, but it is not a substitute for checking the full password's strength. A unique long password containing an ordinary word is not automatically weak.
So the recommendation is really criticizing mandatory rules that influence user behavior, not claiming that an equally random 20-character password is weaker than an equally random 8-character password.