How to Create a Strong Password: The 2026 Guide

To create a strong password, let a cryptographically secure generator pick at least 16 random characters, use that password on exactly one account, and keep it in a password manager. Symbols help a little; length and real randomness do the heavy lifting. For the handful of passwords you have to type from memory, such as the manager's master password or a laptop login, use a passphrase of randomly chosen words instead.

What makes a password strong: randomness and length

A password is strong when an attacker has to try an enormous number of guesses before hitting it. For a randomly generated password that number is the size of the character pool raised to the length, and it's usually written as entropy in bits:

H = L × log₂(R)

H = entropy in bits
L = length in characters
R = size of the character pool (26 lowercase, 62 letters + digits, 95 printable ASCII)

The formula assumes every character was chosen at random. Summer2026! is 11 characters from the full 95-character pool, which on paper is 72 bits. In practice it's a dictionary word, a year and an exclamation mark, and the rule files that ship with hashcat (best64.rule and friends) generate exactly that kind of candidate early in a run. A password you invented gets the entropy of the pattern you used, not the entropy of its length.

How long each length survives a GPU

The worst case for you is a site that stored passwords as unsalted MD5 and then leaked the database. A single RTX 4090 runs about 164 billion MD5 guesses per second (hashcat 6.2.6). Behind bcrypt at cost 10 the same card manages about 5,750. These are the times to try every combination of a random password from all 95 printable characters:

On average an attacker finds it in half that time, and a rented 8-GPU rig divides it by eight again. You never get to choose the hash, which is why I size passwords for the MD5 column. Twelve random characters already put exhaustive search out of reach on today's hardware. Sixteen is the margin for sites that store passwords badly and for the hardware of the next decade. If you want the full benchmark table and the bcrypt math, it's in how long it takes to crack a password.

Length beats symbols, and NIST agrees

Switching from letters and digits to the full printable set lifts each character from 5.95 to 6.57 bits. On a 16-character password that's about 10 extra bits in total. Two more letters or digits add about 12. So when a site lets you choose, a longer password is the better trade than a more "complex" one.

The standards caught up with this. NIST SP 800-63B Rev. 4 (2025) requires at least 15 characters when a password is the only authenticator and 8 when it's one factor of MFA. It also says verifiers shall not impose composition rules (no forced symbol or uppercase), shall not require periodic changes, should accept at least 64 characters, and shall check new passwords against a blocklist of common and breached ones. Plenty of sites still enforce the old rules, so I leave every character set switched on in the generator: it costs nothing and gets past the "must contain a symbol" forms. Where a site caps length at 20 or so, use the full cap.

How I create passwords

For almost everything I don't create passwords at all. The generator makes them and the password manager stores and fills them (I use the browser's built-in manager plus Psono). I never see most of them.

The few I have to type myself are passphrases with a random part mixed in. The thing to understand about that approach is that only the random part counts. A word picked by a generator or by dice from the EFF long list is worth 12.9 bits. A random chunk of 4 printable characters is worth about 26 bits. A word you chose because you like it is worth close to nothing, because attackers build their wordlists from exactly the words people like.

Six random words land in the same place as 12 random characters and are far easier to type on a phone. For a master password, that's the length I'd start at. The trade-offs are covered in more detail in passphrase vs password.

Generate one in the browser

1. Open the Password Generator. It runs entirely in the page, so the password is created on your machine and never sent to a server.
2. Set the length to 16 or more (20 for your email and your password manager), and keep all character sets enabled unless the site rejects a symbol.
3. For something you'll type by hand, switch to passphrase mode and pick 6 words; the entropy is shown live as you change options.
4. Save it straight into your password manager before you paste it into the sign-up form.

The generator draws from crypto.getRandomValues(), the browser's CSPRNG. That matters more than it sounds: Math.random() in V8 is xorshift128+, and a handful of its outputs are enough to reconstruct its state and predict what comes next. A password built on it is only as secret as the numbers the same page produced before. To see how a password you already use holds up, the Password Strength Checker shows its entropy in bits and the crack-time estimate behind the score.

Reuse is what actually gets accounts taken over

Brute force is the slow path. The fast one is credential stuffing: attackers take email and password pairs from one breach and replay them against every other login they can find. In July 2024 a file called rockyou2024.txt with 9,948,575,739 unique plaintext entries was posted on a hacking forum (reported by Cybernews). Much of it was older leaks recompiled, which is the point: once a password is in a list like that, its length stops mattering on every site where you reused it.

Variations don't help either. Coffee!Gmail and Coffee!GitHub are one password with a predictable suffix, and a cracker who has one will try the other. One random password per account is the only version of this rule that works, and it's only practical with a manager. I covered the other habits that undo strong passwords in 10 common password mistakes.

What to tell friends and family

When non-technical friends or family ask me, my answer is short: use a password manager and let it make the passwords. Everything above follows from that one change. They stop reusing, the passwords get long and random without effort, and they only have to remember one good passphrase.

If they're worried about where the manager keeps everything, the honest comparison is with the notebook or the one reused password they have now. For the browser-versus-dedicated question, see are browser password managers safe. Then the next step is turning on two-factor authentication for their email, since that's the account every password reset goes through.

FAQ

How long should a strong password be?

NIST SP 800-63B Rev. 4 sets 15 characters as the minimum when a password is the only factor, and 8 when it's paired with MFA. When a generator creates the password and a manager fills it in, there's no reason to stop at the minimum: 16 to 20 random characters cost you nothing to use.

Why is length better than complexity?

The pool size only grows once: from 26 to 62 to 95, no further. Length is an exponent, so every added character multiplies the keyspace by the pool size again. A 16-character lowercase password (4.4 × 10²² combinations) beats a 10-character password from all 95 printable characters (6 × 10¹⁹).

Should I create passwords myself or use a generator?

A generator. Even careful people produce patterns: a base word, a capital at the front, digits and a symbol at the end. Cracking tools apply those transformations to huge wordlists, so a self-made password falls far sooner than its length predicts.

Is a passphrase as strong as a random password?

It can be. The entropy comes from how many words there are on the list and how many you pick at random, not from how long the phrase looks. Six EFF words (77.5 bits) match 12 random characters. "ilovemydogmax2019" is 17 characters and is weak.

Do strong passwords still need special characters?

Current NIST guidance says sites shouldn't require them. They still add a little entropy, and many sign-up forms still insist on one, so leave them enabled in the generator unless a site refuses a particular symbol.