How to Create a Strong Password (and Remember It)

To create a strong password, make it long, random and unique: at least 16 characters chosen by a password generator, or a passphrase of 7 or more random words, never reused on another site. Store it in a password manager and switch on two-step verification. Clever substitutions like “P@ssw0rd” do not make a password strong.

What makes a password strong

Attackers rarely guess passwords one by one at a login page. They use lists of billions of leaked passwords, common words and predictable patterns, then test them at enormous speed against stolen password databases. A strong password is one that does not appear in those lists and cannot be reached by those patterns, which means it must be random and long.

Strength is measured in bits of entropy: each extra bit doubles the number of guesses needed.

Password	Entropy	Verdict
8 lowercase letters	37.6 bits	Weak: cracked in about a second offline
8 letters and numbers	47.6 bits	Fair: minutes to hours offline
12 random characters, all types	77.7 bits	Strong
16 random characters, all types	103.6 bits	Very strong
7 random words (EFF short list)	72.4 bits	Strong and easy to type

These figures assume the password is truly random. A 12-character password you invent yourself, such as a name plus a year and a symbol, is far weaker than the table suggests, because attackers try those patterns first.

Password best practices in 2026

Guidance from the US National Institute of Standards and Technology (NIST SP 800-63B, revised in 2025) and the UK National Cyber Security Centre is clear:

1. Use a different password for every account. When one site is breached, reused passwords are tried everywhere else (“credential stuffing”).
2. Prefer length to complexity. NIST now tells sites not to force mixes of symbols and numbers, and to require at least 15 characters when a password is the only login factor.
3. Use a password manager. It creates and remembers unique passwords for you, and only fills them on the real website, which protects against phishing.
4. Turn on two-step verification (2FA). An authenticator app or passkey stops most account takeovers even if a password leaks.
5. Change passwords only when needed. Forced regular changes lead to weaker, predictable passwords. Change one when a site reports a breach or you think it has been exposed.

Three ways to create a strong password

1. Let a generator choose it

The simplest and strongest option for accounts you save in a password manager. Our password generator runs in your browser using its cryptographically secure random number generator, so passwords are never sent anywhere.

2. Use random words for the passwords you type

For the few passwords you must remember, such as your password manager, computer login or email, use a passphrase of randomly chosen words, for example draw-silly-cake-wise-quota-scam-sniff. The words must be picked at random, ideally by a generator or with dice, not chosen by you. The NCSC’s “three random words” advice is a good minimum for everyday accounts; for your most important accounts, use more words.

3. Upgrade to passkeys where you can

Many sites now offer passkeys, which replace the password with a key stored on your phone or computer and unlocked with your fingerprint, face or PIN. Passkeys cannot be guessed, reused or phished, so switch to them where they are available.

Strong password examples (and why not to use them)

Examples help you see what strong looks like, but never use a password you have seen published anywhere, including here:

• Random password: _%uY_3.}OIrR:.<3 (16 characters, all types)
• Passphrase: Lying7-Hurt-Woozy-Empty-Mop-Fang (6 random words, a number, capitals)

Generate your own fresh ones instead.

Check whether your password has leaked

Services such as Have I Been Pwned let you check whether your email address appears in known breaches. Many password managers also warn you about reused or breached passwords. If a password shows up, change it everywhere you used it and turn on two-step verification.

Frequently asked questions

How long should a strong password be?

At least 16 random characters, or 7 or more random words for a passphrase. Longer is better and costs nothing when a password manager fills it in.

Are special characters required for a strong password?

No. Length and randomness matter more. NIST tells websites not to force symbol and number rules, though some sites still require them.

Is it safe to write passwords down?

A written list kept securely at home is safer than reusing the same password everywhere. A password manager is better still.

How often should I change my password?

Only when there is a reason, such as a breach notification or suspected exposure. Regular forced changes tend to make passwords weaker.

Sources

• NIST SP 800-63B: Digital Identity Guidelines, Authentication
• NCSC: Top tips for staying secure online
• NCSC: Three random words
• FIDO Alliance: Passkeys
• Have I Been Pwned