How to Create a Genuinely Strong Password
Security - 3 min read - Published 2026-08-27 - Updated 2026-10-19
Most password advice still sounds like it did twenty years ago: at least eight characters, an uppercase letter, a number and a symbol, changed every 90 days. That advice produced passwords like Summer2026! - which satisfy every rule and are among the first things attackers try. Current guidance is simpler and works better: make passwords long, make them unique, and don't make them predictable.
How passwords actually get cracked
Attackers rarely guess passwords one at a time on a login page; most sites lock that down. The real risks are offline cracking and reuse. When a site is breached, its stored password hashes can be tested against billions of guesses per second on ordinary hardware. Guesses start with leaked passwords from earlier breaches, dictionary words and common patterns: capital first letter, number at the end, an exclamation mark, letters swapped for look-alike digits (P@ssw0rd).
The other big risk is credential stuffing: taking email and password pairs leaked from one site and trying them on others. If you reuse a password, one breach anywhere unlocks every account that shares it, however strong the password is.
Length beats complexity
A password's strength is how many guesses it takes to find it, often expressed in bits of entropy: each extra bit doubles the number of possibilities. For a randomly generated password, every character adds a fixed amount. With 26 lowercase letters, each character adds about 4.7 bits; with all 94 printable keyboard characters, about 6.6 bits.
So an 8-character random lowercase password has about 37.6 bits, and a 12-character random password using all 94 characters has about 78.7 bits - around two trillion times more possibilities. Adding length is the most effective way to add strength, and it doesn't require memorizing odd symbols.
These numbers only apply to randomly generated passwords. A password you invent, however long, is usually far weaker than its length suggests, because people choose predictable words and patterns.
Passphrases
A passphrase is several random words, such as lantern-orbit-crumble-velvet-ivy. If each word is picked truly at random from a list of 7,776 words (the size of the widely used diceware lists), each word adds about 12.9 bits, so five words give about 64.6 bits - strong, and much easier to type and remember than a jumble of symbols.
The key word is random. A famous quote, song lyric or meaningful phrase is not random, and attackers include such phrases in their guess lists. Let a generator or dice pick the words.
What current guidance recommends
The US National Institute of Standards and Technology's digital identity guidelines (NIST SP 800-63B), which many organizations follow, recommend allowing long passwords (at least 64 characters), not forcing arbitrary composition rules such as "must contain a symbol", not forcing regular changes unless there's evidence of a compromise, and checking new passwords against lists of known-breached passwords.
Forced regular changes tend to produce weaker passwords, because people make small predictable edits: Autumn2026! becomes Winter2026!. Changing a password promptly when a site reports a breach matters far more.
The practical setup
Use a password manager. It generates a long random password for every site, remembers them all, and fills them in, so you only need to remember one strong master passphrase. Most browsers and phones include one, and dedicated apps are available.
Make the master passphrase five or more random words, and turn on two-factor authentication for the password manager, your email account and anything financial. Email matters most: whoever controls your inbox can reset most of your other passwords.
Check whether a password has already appeared in a breach. Services such as Have I Been Pwned can do this without ever receiving the password itself: only the first few characters of its hash are sent, and the comparison happens on your device.
A quick checklist
Use a different password for every account. Let a generator create them: 16 or more random characters, or five or more random words. Store them in a password manager. Turn on two-factor authentication wherever it's offered, starting with email. Change a password when the site reports a breach, not on an arbitrary schedule.