How to Create a Strong Password in 2026
Password advice has changed a lot in the last decade. The old rules (at least one capital, one number, one symbol, change it every 90 days) produced passwords like Summer2026! that are hard for people to remember and easy for computers to guess. Here is what actually makes a password strong today, and how to create one in under a minute.
How passwords really get broken
To choose a good password it helps to know how attackers work. Almost nobody “guesses” your password by hand. Instead:
- Credential stuffing: attackers take email and password pairs leaked from one website and automatically try them on thousands of others. If you reuse passwords, one breach anywhere unlocks you everywhere.
- Offline cracking: when a site’s database of password hashes is stolen, attackers use GPUs to test billions of guesses per second. They start with lists of real leaked passwords, dictionary words, names and dates, then apply the tweaks people make: capitalising the first letter, swapping
afor@, adding123or!at the end. - Phishing: a fake login page simply asks you for the password. No password strength helps here, which is why two-factor authentication matters.
The three rules that matter
1. Make it long
Length is the single biggest factor. Every extra random character multiplies the number of possibilities an attacker must try. A random 8-character password can be brute-forced offline in hours; a random 16-character password would take longer than the age of the universe. Current NIST guidance (SP 800-63B) requires sites to accept passwords of at least 64 characters, so long passwords are welcome nearly everywhere.
2. Make it random
Humans are terrible at randomness. Anything you “think up” follows patterns that cracking tools already know: words, names, keyboard walks like qwerty, dates and predictable substitutions. The safest password is one generated by a computer with a cryptographically secure random source, such as our random password generator.
3. Make it unique
Use a different password for every account. This is the rule that protects you from credential stuffing, the most common way accounts are taken over. It’s impossible to remember dozens of random passwords, which is exactly what password managers are for.
Two good formats
| Format | Example | Best for |
|---|---|---|
| Random characters, 16+ long | vR7#qL2m!Xa9&tPe |
Accounts your password manager fills in for you |
| Random-word passphrase, 5–6+ words | sprout-ladle-marina-unwind-cobalt |
Passwords you must type from memory: device logins, your password manager’s master password |
Read more about choosing between them in Passphrase vs Password: Which Is More Secure?
What to avoid
- Personal information: names, birthdays, anniversaries, phone numbers, vehicle numbers, pet names or your favourite team.
- Single dictionary words, even with substitutions (
P@ssw0rdis in every cracking list). - Patterns:
123456,abc123,qwerty,111111. - Variations of an old password (
Rahul@2025→Rahul@2026). - Any password that has appeared in a data breach. Check yours with the breach checker.
A one-minute routine for every new account
- Open the password generator, set the length to at least 16 and leave all character types on.
- Copy the password and save it in your password manager before submitting the signup form.
- Turn on two-factor authentication in the account’s security settings.
Should I change my passwords regularly?
No, not on a schedule. Both NIST and the UK NCSC now advise against forced periodic changes, because they push people toward weaker, predictable passwords. Change a password when there’s a reason: the service reports a breach, the password shows up in breach data, or you suspect someone else knows it.
Check your work
Paste a password similar to the one you plan to use into our strength checker. It uses the zxcvbn estimator to show roughly how long the password would survive an offline attack, and explains any weaknesses it finds.