How to Create a Strong Password

What actually makes a password strong?

A strong password is long enough to resist guessing, selected unpredictably, and used for exactly one account. Those three properties matter more than clever substitutions or a complicated-looking pattern.

Length expands the number of possible passwords an attacker may need to try. Random selection prevents the result from following human habits, names, dates, keyboard paths, quotations, or common word combinations. Uniqueness prevents a breach at one company from unlocking an account somewhere else through credential stuffing.

NIST’s current public guidance recommends at least 15 characters when you create a password and emphasizes password managers, multifactor authentication, and passkeys. Its technical guidance also explains that forced composition rules often produce predictable responses such as capitalizing the first letter and appending a number or symbol.

Method 1: Generate a random password

This is the preferred method when a password manager can store and fill the result. You do not need to memorize a 20- or 24-character random string if software can manage it safely.

1. Open a trusted password manager’s generator or use this site’s private password generator.
2. Select a length of at least 15 characters. A 20-character default provides more margin while remaining compatible with most modern services.
3. Keep uppercase letters, lowercase letters, numbers, and symbols enabled unless the website rejects a character type. Length and randomness still matter when compatibility forces a smaller alphabet.
4. Generate the password, enter it only on the intended site, and save it under the correct website and username in your password manager.
5. Generate a completely new value for the next account. Do not modify the old password with a different number, site name, or year.

Method 2: Generate a random passphrase

A passphrase is useful when you need to type the credential frequently, remember it temporarily, or protect the password-manager vault itself. The words must be selected independently at random from a sufficiently large list. A favorite quotation, song lyric, sentence, or personally meaningful phrase is not random.

1. Use a documented random passphrase generator or roll physical dice with the Diceware generator.
2. Use enough random words for the account’s risk and the generator’s documented word list. More words increase the search space.
3. Preserve the chosen words instead of replacing them with a personal reference.
4. Add capitalization, digits, or a separator only when a site requires them; do not treat a predictable exclamation point as the main source of strength.
5. Store the finished passphrase securely and never reuse it.

Why common password tricks fail

Password-cracking tools test common patterns early. They know that people replace “a” with “@,” put an uppercase letter first, append “1!,” add a birth year, or attach the website name to a shared base word. These transformations may satisfy a form without creating much unpredictability.

• Do not use these examples: patterns like Summer2026!, a pet name plus a birthday, or a keyboard path plus a symbol are illustrative weak structures, not password suggestions.
• Do not join several common words that form a familiar saying and assume the length alone makes it safe.
• Do not reuse one “strong” password. Reuse converts a single breach into a risk across every account sharing that value.
• Do not create a sequence of variations such as changing only the final number each month.
• Do not share a password through ordinary email, chat, or a document when a secure access-sharing feature is available.

How long should a password be?

For a new general-purpose password, use at least 15 characters when the service permits it. A machine-generated password can comfortably be longer because you do not need to remember it. Some routers, legacy applications, and workplace systems impose specific limits, so always follow the accepted range without reducing randomness more than necessary.

Character variety expands the alphabet available to a random generator, but length is the clearer priority for a person choosing a memorized secret. NIST no longer recommends that services force every password to contain a specific mixture of uppercase letters, lowercase letters, numbers, and symbols. Many sites still impose those requirements, and a generator can meet them without introducing a human pattern.

Store passwords instead of memorizing them all

A password manager lets every account have a long, unique credential without demanding that you remember dozens of random strings. Protect the vault with a strong, unique passphrase and multifactor authentication. Keep recovery information current, understand how the provider handles backups and account recovery, and install updates promptly.

A notebook stored securely in a controlled physical location can be safer than reusing a few passwords, but it is less convenient for autofill and may not fit every threat model. Unencrypted notes, spreadsheets, screenshots, browser URLs, and messages are poor places for password storage.

Add MFA or use a passkey

A strong password cannot stop every attack. Phishing, malware, social engineering, and session theft may bypass or capture even a long random password. Turn on multifactor authentication for email, financial accounts, cloud storage, social media, and the password manager itself.

When available, a passkey can replace the password with a cryptographic credential tied to the legitimate website. NIST identifies WebAuthn-based authentication as phishing-resistant because the credential is bound to the verifier’s domain. Prefer phishing-resistant options such as passkeys or hardware security keys for high-value accounts when they are supported.

When should you change a password?

Change it promptly if the service reports a breach, you entered it on a suspicious site, malware may have captured it, someone else learned it, or you discover that it was reused. Update every account that shared an exposed value, starting with email and the password manager.

A routine forced schedule can encourage small, predictable changes. Current NIST guidance tells verifiers not to require arbitrary periodic changes, while requiring a change when there is evidence of compromise. Your employer or regulated system may still enforce its own policy; follow that policy without reusing the replacement elsewhere.

A practical account checklist

• Generate a new random password or passphrase for this account only.
• Use at least 15 characters unless the service has a different technical limit.
• Save the exact website address and username with the credential.
• Enable MFA or a passkey and securely store recovery codes.
• Verify that the password manager can autofill the correct domain before relying on it.
• Replace the credential quickly if exposure or reuse is discovered.

Sources and scope

This independent guide was reviewed against current NIST and CISA material on September 24, 2026. The recommendations are general consumer guidance; an employer, administrator, regulated system, or device may impose additional requirements.

• NIST: How Do I Create a Good Password?
• NIST SP 800-63B-4: Authentication and Authenticator Management
• CISA: Use a Password Manager to Create and Remember Strong Passwords