How to Create a Strong Password (What NIST Recommends in 2026)
Create a strong password: length beats complexity. Learn about passphrases, why a password manager matters and how to add two-factor authentication.
By Awais, Founder and editor-in-chiefPublished
A strong password is long, random and used for only one account: aim for at least 15 characters, or a passphrase of five or six random words, and let a password manager remember it for you. Then turn on two-factor authentication, because even a perfect password can be stolen by a fake login page.
That advice matches the current US government guidance, NIST Special Publication 800-63B-4, finalised in July 2025. This guide explains why length matters more than symbols, how to build a passphrase, and what to do beyond the password itself.
What NIST now says about passwords
The US National Institute of Standards and Technology (NIST) writes the digital identity guidelines used by US federal agencies, and many companies follow them too. The latest version, SP 800-63B-4 (publication record), tells websites and services to:
- require at least 15 characters when a password is the only thing protecting an account, and at least 8 when it is used with another factor;
- allow passwords of at least 64 characters, including spaces and Unicode;
- not impose composition rules, such as demanding an uppercase letter, a digit and a symbol;
- not force regular password changes, but force a change if there is evidence the password has been compromised;
- check new passwords against a blocklist of common, expected or already-breached passwords;
- allow password managers and autofill, and let people paste passwords;
- not use password hints or security questions.
These rules are written for the people who build login systems, but they also tell you what a good password looks like: long, unpredictable, and not on any list of known passwords.
Why length beats complexity
Password strength is measured in bits of entropy: how many guesses an attacker would need if they knew exactly how you made the password, but not the password itself. For a truly random password:
Each extra bit doubles the number of guesses. Here is what that gives for random passwords:
| Password type | Example pattern | Entropy |
|---|---|---|
| 8 random characters from all 94 keyboard symbols | k#9Tq!2v |
52 bits |
| 12 random keyboard characters | x7!Rm@p2Lq9# |
79 bits |
| 15 random lowercase letters | qhzkwtrnbvyelcm |
71 bits |
| 16 random keyboard characters | T4%gq9!Zr2#mL8vw |
105 bits |
| 4 random words from a 7,776-word list | crane-velvet-oasis-bluff |
52 bits |
| 6 random words from a 7,776-word list | maple-quarry-ember-tunic-sleet-poem |
78 bits |
Two things stand out. First, adding length gains strength faster than adding symbol types: 15 lowercase letters beat 8 characters with every symbol. Second, the numbers only apply to random choices. Summer2026! uses all four character types, but it follows a pattern attackers try early, and passwords like it appear in breach lists. Its real strength is far lower than its length suggests.
To put 78 bits in perspective: that is about 2^77 guesses on average. At a hypothetical trillion guesses per second, working through 2^77 options would take roughly 4,800 years.
Option 1: a random password from a generator
The easiest strong password is one you never have to remember:
- Open the Password Generator.
- Set the length to 16 characters or more. Use 20 or more for email and banking.
- Keep letters, numbers and symbols on, unless a site rejects some symbols.
- Copy the password straight into your password manager and the site’s sign-up form.
Our generator creates passwords in your browser using its built-in secure random number generator. The password is not sent anywhere or stored.
Option 2: a passphrase you can remember
For the few passwords you must type from memory, such as your computer login or your password manager’s master password, use a passphrase made of random words.
The Electronic Frontier Foundation’s dice method works like this: roll five dice, read the numbers as a five-digit code, and look up the matching word in EFF’s long wordlist. Repeat for each word. EFF suggests six words for most uses, which gives about 2^77 possibilities.
The key word is random. A passphrase you invent yourself, such as a song lyric or a famous quote, is much weaker, because attackers feed those into their guessing lists too. Let dice or a generator pick the words, then make up a silly picture in your head to remember them. Our Password Generator has a Passphrase mode that picks random words for you.
Option 3: let a password manager do it
You need a different password for every account. When one site is breached, attackers try the leaked email and password on other sites, a technique called credential stuffing. Reusing passwords turns one breach into many.
Nobody can remember 100 random passwords, so use a password manager. Good options are built into Apple devices, Android, Google Chrome and Microsoft Edge, and there are independent managers too. A manager:
- creates a strong, unique password for each site;
- fills it in only on the real site, which also helps protect you from fake login pages;
- warns you about reused or breached passwords.
Protect the manager with a long passphrase and two-factor authentication.
Add a second factor
A password alone can be phished, guessed or leaked. Two-factor authentication (2FA, or multi-factor authentication, MFA) adds a second proof, so a stolen password is not enough on its own. The US Cybersecurity and Infrastructure Security Agency says users who enable MFA are significantly less likely to get hacked, and calls phishing-resistant MFA such as FIDO/WebAuthn the standard to aim for (CISA).
| Second factor | How it works | Strength |
|---|---|---|
| Passkey or security key | Your device proves who you are with cryptography; it only works on the real website | Strongest: resists phishing |
| Authenticator app | A 6-digit code that changes every 30 seconds | Strong, but codes can be phished |
| Push notification | Approve a prompt on your phone | Good, if you never approve prompts you didn’t expect |
| SMS code | A code sent by text | Better than nothing, but open to SIM swap and phishing |
Start with your email account. Whoever controls your email can reset most of your other passwords.
Passwords to avoid
- Anything with your name, birthday, phone number, pet’s name or favourite team.
- Keyboard patterns:
qwerty,1qaz2wsx,123456789. - Common words with simple swaps:
P@ssw0rd,Pakistan123,Welcome1!. - A strong password with a number on the end that you change each time you are asked to reset it.
- Any password you have used on another site.
What to do after a data breach
- Change the password on the breached site, and on any other site where you used the same one.
- Turn on two-factor authentication if it was off.
- Watch for phishing emails that mention the breach; attackers use the news as bait.
- Check your password manager’s security report for other reused passwords.
If you are a developer storing passwords, never store them as plain text or with a fast general-purpose hash. Use a slow password-hashing algorithm such as Argon2id, bcrypt or scrypt. A hash generator is useful for checking file checksums, but it is not a substitute for proper password hashing. For handling secrets in config files, see how to format JSON.
FAQ
How long should my password be?
At least 15 characters for any account protected only by a password, which matches NIST’s minimum. For important accounts, use 20 or more random characters, or a passphrase of six random words.
Do I still need symbols and numbers?
Not if the password is long and random. NIST tells services not to force character mixes. Some sites still demand them, so a generator that includes symbols covers both cases.
Should I change my passwords regularly?
Only when there is a reason, such as a breach or a suspicion that someone knows your password. NIST advises against forced periodic changes, because they push people toward weak, predictable patterns.
Is it safe to use an online password generator?
It is safe if the generator runs in your browser and does not send the password anywhere. Ours works that way. Avoid generators that create passwords on a server or ask you to sign in.
Are passkeys better than passwords?
Yes, for the sites that support them. A passkey can’t be reused, guessed or typed into a fake site. Keep a strong password as a backup where you still need one.