Is a simple, but very long password a good password?

Well it depends on what method the attacker is using to crack passwords. If they are using dictionary attacks, certainly this will be very safe. After that, the attacker can try pure brute-forcing, and those methods usually try all shorter passwords before longer ones. So against common automated attacks like these, you are probably pretty safe.

As mentioned, it might be a little awkward to type in a password like this around people, since it's easy to "read" from your keystrokes. However, it wouldn't be that hard to modify these simple passwords to be a little more complicated to make them harder to read.

The way we calculate the strength of any password is this: Take the number of possibilities for a character raised to the number of characters. So, a 4 digit PIN is 10^4 = 10,000, and a 8 character lower case password is 26^8 = 208,827,064,576.

This extends to non-characters as well. For example, a password made up of 4 unrelated words from a list of 1000 most common words would have 1000^4 = 10^12 possibilities.

Now, with respect to your proposed method of a repeated character, we must ask what information is actually carried in 25 w's? In other words, what is the minimum amount of room we could convey that information in? It would seem there are two pieces. First, the character, and second, the number of repetitions. Meaning that a w repeated 25 times only has 26 * 25 = 650 possibilities. Granted, that is the worst case, where the attacker knows the character type and stops at the correct length, but I feel that is reasonable as they would likely work up to that length starting at 1.

I really like this password tester. It shows your password has about 15 bits of entropy. Compared to just wg9, which has about 18 bits.

The take away is that while a long repeated string does add some entropy to your password, it adds less than just adding another (different) character would add. If you are willing and able to use long passwords, use a passphrase instead.

If the attacker does not suspect your strategy, your example has higher entropy than most "usual" passwords.

However, it would be easier to memorize and type if you had multiple simple words, and it would be also less prone to being defeated by an attack that specially scans for your initial idea (for example, if it ever becomes a fashion)

The obligatory xkcd reference as a demonstration: