How to Create a Strong Password: The Complete 2026 Guide

Why Your Old Password Rules Were Making Things Worse

For roughly two decades, the standard advice was: use uppercase, lowercase, a number, and a symbol, and change it every 90 days. That advice came from a 2003 NIST document written by a manager named Bill Burr, and Burr himself later told the Wall Street Journal he regretted much of it. The rules did not come from studying how real attacks succeed, they came from an educated guess about password composition, and in practice they backfired. Forced complexity pushed people toward predictable patterns like capitalizing the first letter and tacking "!" onto the end. Forced rotation pushed people to increment a number, Password1 becomes Password2 becomes Password3, a pattern any cracking tool tries in the first few seconds. NIST has since rewritten its own guidance to undo this damage, and password length now matters far more than complexity.

The Updated NIST Guidelines (SP 800-63B, 2024 Revision)

NIST, the US National Institute of Standards and Technology, whose guidance many companies and government agencies follow directly, made several changes that reverse decades of bad advice:

• Minimum 15 characters for memorized passwords, an increase from the old 8-character minimum, since length is what actually drives entropy
• No mandatory composition rules. Sites should stop forcing a mix of uppercase, symbols, and digits if the user does not want them
• No mandatory periodic rotation. Do not force a password change every 90 days unless there is actual evidence of compromise; rotation without cause trains users into weaker, predictable patterns
• Check new passwords against known-breached lists and reject anything that already appears in a breach dump, since attackers try those first
• Allow paste into password fields, since blocking paste breaks password managers and pushes users toward memorable, weaker choices
• Support at least 64 characters so long passphrases and generated passwords are never truncated

The throughline in all of these changes is that NIST stopped optimizing for "looks complex to a human" and started optimizing for "resists a computer guessing billions of times per second."

Entropy: The Math Behind Password Strength

What Entropy Actually Measures

Entropy, measured in bits, describes how many guesses an attacker needs on average before finding your password. Each character position multiplies the search space by the size of the character set you draw from. The formula is straightforward: entropy in bits equals the logarithm base 2 of (character set size raised to the power of password length), or written out, bits = log2(charset_size^length).

A Worked Calculation

Take a 12-character password drawn from a realistic 95-character set (all printable ASCII: uppercase, lowercase, digits, and symbols). The total number of possible passwords is 95 raised to the 12th power, which works out to roughly 5.4 x 10^23 combinations. Taking log2 of that number gives approximately 78.8 bits of entropy. Now compare that to a 20-character password using just lowercase letters, a 26-character set. That is 26 raised to the 20th power, roughly 2.0 x 10^28 combinations, or about 94 bits of entropy. The plain lowercase password, despite using a smaller character set, has more entropy simply because it is longer. This is the mathematical proof behind "length beats complexity": each additional character multiplies the search space, while each additional character set only adds a fixed, much smaller multiplier per position.

*Assuming 10 billion guesses per second, a realistic figure for offline cracking against a leaked, unsalted hash on modern GPU hardware.

Building a Passphrase the Diceware Way

A passphrase strings together several random, unrelated words: "umbrella forest delta cookie" style. It reads easier than a wall of random characters and, done correctly, carries plenty of entropy. The key word is random. A phrase that means something to you (your dog's name plus your anniversary) is not random at all, it is exactly the kind of pattern breach databases and cracking dictionaries are built to catch.

Diceware is the standard method for generating a genuinely random passphrase, and it works like this:

1. Get a Diceware word list, a public list mapping every combination of five dice rolls (numbers 1 through 6) to one common word. The original list has 7,776 words, since six raised to the fifth power equals 7,776.
2. Roll a physical die five times (or use a cryptographically secure random number generator) to get a five-digit number, for example 3-6-1-4-2.
3. Look up that number on the word list to get your first word.
4. Repeat the process to build up 5 or 6 words total.
5. String the words together with spaces or hyphens.

Each Diceware word carries about 12.9 bits of entropy (log2 of 7,776), so a 6-word Diceware phrase carries roughly 77 bits, comfortably in the "months to years" range even against fast offline cracking, and a 7-word phrase pushes past 90 bits. The critical part is using actual dice or a proper random source for word selection, not just picking words that feel random to you, since human brains are notoriously bad at generating true randomness and tend toward the same predictable word choices over and over.

The Golden Rules

1. Use a password manager. 1Password, Bitwarden, or KeePassXC. Let it generate and remember every password so you never have to.
2. Give every account a unique password. Reuse is the single most damaging pattern in real-world breaches, since one leaked password gets tried against every other account you own.
3. Aim for 15+ characters on generated passwords, and 20+ where the site allows it.
4. Turn on 2FA everywhere it is offered. A stolen password is useless if a second factor blocks the login. See our guide on 2FA vs MFA for what to enable where.
5. Never use personal details: birthdays, pet names, favorite teams, street names. All of it is searchable on social media in minutes.
6. Never reuse your email password anywhere. Email is the master key that resets everything else, so it deserves your strongest, most unique password.

Patterns Cracking Tools Already Know

Password cracking tools like Hashcat ship with rule sets built specifically to catch "clever" human patterns, so anything that feels like a clever trick to you is almost certainly already in their rule files:

• Any dictionary word, in any language, is tried first, often within the first few minutes of an attack
• Names plus numbers, like John1990 or Sarah2024, are covered by "combinator" rules that pair common names with common years and sequences
• Keyboard walks, like qwerty, asdfgh, or 1qaz2wsx, are a specific, well-documented rule category in every major cracking tool
• Leetspeak substitutions, like p@ssw0rd or H3llo, are handled by standard "mangling rules" that swap a for @, e for 3, o for 0, and so on automatically
• Appending a symbol and digit to a dictionary word, like Summer2024!, defeats old-style complexity requirements while remaining trivial for a rule-based attack, since the rule "append year, append symbol" is one of the most common rules in any cracking wordlist
• Anything already in HaveIBeenPwned's password database, which holds over 600 million previously breached passwords and is checked automatically by many modern signup forms

The pattern across all of these: humans are predictable in the same handful of ways, and every cracking tool is built around that predictability. Genuine randomness, whether from a password manager's generator or a proper Diceware roll, is the only thing that sidesteps this entirely.

Generate a Strong Password Right Now

Our free Password Generator creates cryptographically random passwords using crypto.getRandomValues(), the same browser API used for other security-critical operations. Choose a length and character set, then drop the result straight into your password manager.

After generating, run it through our Password Strength Checker to see the estimated entropy and crack time, calculated entirely in your browser with nothing sent to any server. If you would rather build a memorable passphrase than a random string, our guide on passphrase vs password walks through the tradeoffs in more depth.

Frequently Asked Questions

Should I change my password regularly?

No, not unless you have a specific reason to think it has been exposed. The old 90-day rotation rule is explicitly rejected in current NIST guidance, because forced changes push users toward small, predictable edits like Password1 turning into Password2, which are trivial for an attacker to guess.

Is it safe to let my browser save my passwords?

It beats reusing weak passwords everywhere, but it is meaningfully weaker than a dedicated password manager. Browser password stores vary a lot in encryption quality and sync security across vendors. For anything sensitive, banking, primary email, work accounts, use a dedicated manager with a strong master password and 2FA enabled.

How long should a password actually be?

For randomly generated passwords, 16 or more characters is excellent. For passphrases, 5 or 6 truly random Diceware words. For your password manager's master password specifically, aim for 20+ characters or a long passphrase, since that single password protects everything else and you do need to memorize it.

What is the best free password manager?

Bitwarden is open source, independently audited, and its free tier covers most people's needs across every major platform. KeePassXC is a strong fully offline alternative if you would rather avoid cloud sync entirely.

Can a password manager itself get hacked?

Yes, LastPass suffered a significant breach in 2022. However, a well-built password manager encrypts your vault locally with your master password using a slow, memory-hard key derivation function like Argon2 or PBKDF2, so a breach of the company's servers does not hand over your actual passwords. The realistic risk of using a reputable password manager is still far lower than the risk of reusing simple, memorable passwords across dozens of sites.