Most advice about strong passwords is stuck in 2010. Swap an "a" for an "@". Add an exclamation point. Change it every 90 days. None of that reflects how passwords actually get broken today.
Modern attackers don't sit at a login screen guessing. They run stolen password databases through GPU rigs that test billions of candidates per second - And they feed every previously leaked password into their guessing lists first.
Building a password that survives that reality is simpler than the old rules suggested. But it means abandoning a few habits that only ever made passwords harder for humans and easier for machines.
Length is the whole game
Tip: when in doubt, just make it longer.
The strength of a password comes down to how many guesses an attacker would need to find it. Security engineers measure this in bits of entropy - Think of it as a score for unpredictability.
The math is unforgiving in one direction and generous in the other. Each additional truly random character multiplies the total search space. A random 8-character password drawn from all 95 printable ASCII characters has about 52 bits of entropy. Stretch it to 16 characters and you're at roughly 105 bits - Not twice as strong, but billions of billions of times stronger.
That's why the widely cited crack-time tables published by Hive Systems show such a dramatic cliff. Short passwords - Anything under 10 characters, even with symbols - Fall to modern GPU hardware in minutes to days when the site stored them with a fast hash. Long random passwords of 14 characters and up land in "millions of years" territory.
There is no clever trick that substitutes for length. If you want the underlying math in full, our guide to password entropy walks through the bits, the formulas, and real-world crack times.
Rule of thumb: a strong password in 2026 is at least 14–16 random characters, or at least five randomly chosen words. Everything else is secondary.
Why "clever" passwords fail
Humans are terrible at being random, and attackers know exactly how we're not random. Cracking tools like Hashcat don't guess blindly - They apply mangling rules built from decades of leaked passwords. Those rules encode our habits:
- Capitalize the first letter, put the number and symbol at the end (
Sunshine2026!) - Leetspeak substitutions (
P@ssw0rd,Tr0ub4dor) - Keyboard walks (
qwerty,1qaz2wsx,zxcvbnm) - Names, dates, teams, and pet names pulled from social media
A password like M@rgaret1987! feels strong and satisfies every legacy complexity meter. But it's really a dictionary word plus a birth year with predictable decoration - A pattern cracking rules chew through early.
The scale of the problem is huge. Verizon's Data Breach Investigations Report has found stolen credentials involved in roughly a third of breaches over the past decade. The passwords recovered in those breaches keep teaching the tools what humans do.
The lists of what people actually choose are sobering. The same few thousand strings, decorated the same few ways, top the leak charts every single year.
The two methods that actually work
Method 1: a fully random generated password
For any account where a password manager or browser will remember it for you, use a machine-generated random string. A password generator using a cryptographically secure random source can produce something like k7#mQ!vX2p$wR9zL in one click.
That's 16 characters and about 105 bits of entropy - Immune to every dictionary and rule-based attack. You never need to memorize it, so its unmemorability costs you nothing.
Method 2: a random passphrase for things you must type
A few secrets you genuinely need to remember or type by hand: your password manager's master password, your computer login, disk encryption. For those, use a passphrase - Five or six words chosen at random from a large wordlist, like maple-oxide-thrift-canyon-jubilee.
Six Diceware words carry about 77 bits of entropy. Yet they stay typeable on a phone keyboard and genuinely memorizable. The full method, including why the words must be chosen randomly rather than by you, is covered in what a passphrase is and how Diceware works.
How the approaches compare
| Approach | Example | Approx. entropy | Best for |
|---|---|---|---|
| Human "clever" password | Sunshine2026! |
~20–30 bits effective | Nothing - Avoid |
| Random 12 characters | x9$Kp2#mQv7! |
~79 bits | Managed accounts |
| Random 16 characters | k7#mQ!vX2p$wR9zL |
~105 bits | Managed accounts, high value |
| 5-word passphrase | maple oxide thrift canyon jubilee |
~65 bits | Memorized secrets |
| 6-word passphrase | add waffle |
~77 bits | Master passwords, encryption |
What NIST actually recommends now
The current U.S. federal guidance, NIST Special Publication 800-63B, reads like a repudiation of the old rules - Because it is. Its key points:
- Favor length. Verifiers must accept at least 64 characters; longer is better.
- Don't force composition rules. Mandatory symbol-and-number requirements push people toward predictable patterns like
Password1!. - Don't force scheduled resets. Only require a change when there's evidence of compromise. Forced rotation produces
Winter2025→Winter2026. The reasoning behind this change is worth reading in full - See how often you should change your password. - Screen against breached-password lists. A perfect-looking password that appeared in a previous leak is already in attackers' dictionaries.
- Allow pasting, so password managers work.
If a site still forces you into 8–12 characters with mandatory symbols, comply - But make those characters random, not a decorated word.
Uniqueness: the rule that outranks strength
A 100-bit password reused on two sites is only as safe as the weaker site. When any service you use is breached and its password database leaks, criminals immediately replay those email-and-password pairs against banks, email providers, and shops.
That automated attack is called credential stuffing, and it succeeds precisely because most people reuse passwords. Have I Been Pwned's Pwned Passwords corpus contains hundreds of millions of real-world passwords recovered from breaches. Every one of them is effectively public knowledge now.
Practically, uniqueness everywhere is impossible without tooling. Let a manager generate and store a distinct random password per site. If you want a lightweight place to keep generated credentials, the Password Wallet does exactly that in your browser.
One more habit: before trusting any password you've been using for years, run it through a password strength checker that estimates entropy locally rather than sending it anywhere.
Strength is necessary but not sufficient
Even a perfect password can be phished, keylogged, or stolen from a breached server before it's hashed. Two additions close most of that gap:
- Turn on two-factor authentication wherever it's offered - Preferably an authenticator app or passkey rather than SMS. That way a stolen password alone can't open the account. Our two-factor authentication setup guide covers the options in order of strength.
- Check your exposure. See whether your email address appears in known breaches at haveibeenpwned.com. Change any password that was exposed, everywhere it was reused.
A five-minute action plan
- Pick or install a password manager (a browser's built-in one beats nothing).
- Create one strong master passphrase of six random words. Write it on paper and store it somewhere physically safe until it sticks.
- Generate unique 16+ character random passwords for your email, banking, and any account holding payment details - Email first, since it can reset everything else.
- Enable app-based 2FA on those same accounts.
- Fix the rest gradually: every time you log in somewhere with an old reused password, take 30 seconds to upgrade it.
FAQ
How long should a password be in 2026?
At least 14–16 characters if it's randomly generated, or five to six words if it's a passphrase. NIST SP 800-63B requires services to accept much longer passwords, so use the room. Below 12 random characters, modern GPU cracking against weakly hashed databases becomes a realistic threat.
Are password rules like "one symbol, one number" still useful?
No. NIST explicitly recommends against forced composition rules, because they push people toward predictable patterns like a capital first letter and a trailing 1!. A 16-character random string or a six-word passphrase is stronger than any short password, no matter how many symbols the short one contains.
Is it safe to write passwords down?
Writing a master passphrase on paper and keeping it in a safe place at home is far safer than reusing a weak memorable password everywhere. The threats that matter - Phishing, credential stuffing, database breaches - Are remote and automated. A burglar reading your notebook is not the attack model that empties accounts at scale.
Should I change strong passwords regularly?
Not on a schedule. Current NIST guidance says to change a password when there's a reason: the service was breached, the password appeared in a leak, or you suspect compromise. Routine forced rotation produces weaker, incremented passwords and no measurable security gain.
What makes a password "strong" - Length or randomness?
Both, multiplied together. Strength is the size of the space an attacker must search. That space grows with the character pool and exponentially with length - But only if every character is chosen randomly. A long password built from words you picked yourself has far less entropy than its length suggests. That's why generators and Diceware-style word selection matter.