How to Create a Strong Password

A strong password is a long one: use a 16-plus character random string generated by a password manager, or a passphrase of at least five or six random words like stapler-orbit-mango-trench-fable. Length beats symbols because every character you add multiplies the number of guesses an attacker has to try, while swapping an a for an @ barely moves the needle.

The one number that actually measures strength#

Security researchers measure password strength in bits of entropy — roughly, how many yes/no coin flips of uncertainty a password contains. Each bit doubles the number of guesses required. Below about 60 bits, a determined attacker with a stolen password database can crack it; above about 80 bits, it is effectively out of reach with today's hardware.

Here is why length wins. A truly random password drawn from the 94 printable characters on a US keyboard is worth about 6.5 bits per character, so a 16-character random password lands near 105 bits. Even a password using only lowercase letters and digits earns roughly 5 bits each. Meanwhile, the "complexity tricks" people rely on — capitalizing the first letter, ending with 1!, or turning e into 3 — are the first patterns cracking tools try, so they add almost nothing.

What "cracking" really looks like#

When a site is breached, attackers rarely guess passwords one at a time against a login screen. They steal the hashed password file and run it offline. Against a fast, poorly protected hash like unsalted MD5 or SHA-1, a single modern GPU can attempt billions of guesses per second, and a rented rig can do far more. A six-character password — even with symbols — falls in minutes to hours. A 16-character random one, or a five-word passphrase, would take longer than the age of the universe at those speeds. That gap is the whole game.

This is also why the official guidance changed. The US standard, NIST Special Publication 800-63B, now tells organizations to allow passwords up to at least 64 characters, to stop forcing arbitrary symbol-and-number "composition rules," and to stop making you change passwords every 90 days unless there is evidence of compromise. Forced rotation just pushes people toward Summer2026! becoming Autumn2026!.

Build a passphrase you can actually remember#

If you want a password you can type without a manager — for your device unlock or your vault's master password — build it the Diceware way instead of inventing something clever.

The Diceware method, step by step#

1. Get the EFF long word list (a public list of 7,776 short words, each mapped to a five-digit dice roll).
2. Roll a physical die five times to get a number like 4-2-6-1-3, and read off the matching word.
3. Repeat until you have at least five words, then join them with hyphens: willow-cactus-driftwood-anvil-plum.
4. Do not "fix" it to look nicer, and do not pick words that mean something to you — the randomness is the strength.

Each random word from that list is worth about 12.9 bits, so five words gives roughly 64 bits and six words about 77 bits. That is genuinely strong and still picturable in your head. The absurd mental image (a cactus made of driftwood) is what makes it stick.

The key mistake here is fake randomness. Purple-Canoe-Coffee-Mountain looks like the examples you have seen, and that is exactly the problem — human-chosen "random" words cluster around common, guessable choices. Real dice, or a manager's generator, remove that bias.

Let a password manager carry the load#

Nobody can remember a unique 16-character password for 80-plus accounts, and you should not try. A password manager generates, stores, and autofills a different strong password for every site, all locked behind one master passphrase you actually memorize.

Which one to pick#

• Bitwarden — open-source, a genuinely usable free tier, works on every platform. The safe default for most people.
• 1Password — paid (around $3 per month for one person), very polished, with a Watchtower panel that flags reused and breached passwords.
• Apple Passwords — free and built into iPhone, iPad, and Mac (its own app since iOS 18). Great if you live entirely in Apple's world.
• Google Password Manager — free, built into Chrome and Android, managed at passwords.google.com. Best fit for Chrome-and-Android users.
• KeePassXC — free and fully offline; you keep the encrypted vault file yourself. For people who do not want any cloud involved.

Whatever you choose, confirm it uses end-to-end (zero-knowledge) encryption, meaning the company stores only encrypted data it cannot read, and that it syncs across your phone and computer. Then spend real effort on the master passphrase, because it protects everything else: make it a six-word Diceware phrase and never reuse it anywhere.

Give every account its own password#

The single most dangerous habit is reuse. After a breach, attackers take the leaked email-and-password pairs and quietly try them on banks, email providers, and shops — an automated attack called credential stuffing. Reuse one password across five sites and one breach can open all five.

Unique passwords contain the blast radius: a leak at a hobby forum stays at that forum and never reaches your bank. Prioritize in this order:

1. Primary email — it is the reset point for everything else, so it deserves your strongest, most unique password.
2. Banking and anything tied to payments.
3. Cloud accounts (Apple, Google, Microsoft) that hold your files and back up your phone.

To find your weak spots, check your address at haveibeenpwned.com — it tells you which known breaches include your email. On iPhone, open Settings > Passwords > Security Recommendations to see reused and compromised logins flagged for you; in Chrome, go to passwords.google.com and run the Password Checkup. Fix the reused ones first.

Add a second layer, and consider skipping passwords entirely#

A strong password is far tougher with two-factor authentication (2FA), which asks for a second proof at login. Not all second factors are equal:

• Best: a hardware security key (like a YubiKey) using the FIDO2 standard — effectively phishing-proof.
• Good: an authenticator app generating six-digit TOTP codes (Google Authenticator, Microsoft Authenticator, Authy, or the code built into your password manager).
• Last resort: SMS text codes — better than nothing, but vulnerable to SIM-swap attacks, so avoid them for your email and bank if an app option exists.

Turn 2FA on for email, banking, and cloud accounts first. For a Google account, that is myaccount.google.com > Security > 2-Step Verification.

Better still, adopt passkeys where they are offered. A passkey replaces the password with a cryptographic key pair: the private half never leaves your phone or laptop, so there is nothing to phish, steal in a breach, or reuse. Google, Apple, Microsoft, Amazon, and many banks now support them, and your device syncs them through iCloud Keychain or Google Password Manager. Where you see "set up a passkey," take it.

Common mistakes to avoid#

• Counting on l33tspeak and a trailing 1! to make a short password safe — cracking tools model these patterns first.
• Choosing your own "random" words instead of using dice or a generator.
• Storing passwords in a browser note, a spreadsheet, or a phone note instead of an encrypted manager.
• Protecting your master passphrase or email with a weak, reused password — those two are the keys to the whole kingdom.

FAQ#

How long should a password actually be?#

For a random password from a manager, 16 characters is a strong target and gives around 100 bits of entropy. For a memorized passphrase, use at least five random words (about 64 bits) — six for anything critical like your master passphrase or email.

Do I still need to change my passwords every few months?#

No. Current NIST guidance advises against scheduled rotation because it pushes people toward tiny, predictable tweaks. Change a password only when a service reports a breach, a checker flags it as compromised, or you suspect the account was accessed.

Are password managers safe if the company gets hacked?#

A zero-knowledge manager only stores data encrypted with your master passphrase, which it never sees, so a server breach exposes unreadable ciphertext rather than your logins. The real risk is a weak master passphrase, so make that one long and unique and pair it with 2FA.

What is the difference between a passkey and a strong password?#

A password is a shared secret you type and a server stores a hash of; a passkey is a cryptographic key pair where the private key never leaves your device. Passkeys cannot be phished, guessed, or leaked in a database breach, which is why they are the more secure option wherever a site supports them.