How to Create a Strong Password

What Makes a Password Strong?

A strong password is long, unpredictable, and used on only one account. The properties below determine how hard a password is to crack.

• Length sets the cracking cost. Each added character multiplies the combinations an attacker must test, so a 16-character password resists offline cracking far longer than an 8-character one.
• Entropy measures unpredictability. Entropy counts how many guesses a password could be, in bits, and rises with both length and the randomness of each character.
• Uniqueness limits breach damage. A password used on one account cannot unlock others, so a single breach stays contained to that one service.
• Unpredictability defeats dictionaries. Attackers test common words, leaked passwords, and keyboard patterns first, so a password that avoids those survives longer.

Length matters more than symbol variety. A 16-character passphrase of plain words reaches higher entropy than an 8-character mix of letters, numbers, and symbols. The 2025 NIST guidance reflects this by raising the length floor while removing rules that forced specific character types.

How Long Should a Password Be?

Aim for at least 16 characters, and treat 15 as the hard floor for any account where the password is your only factor. The counts below map length to practical resistance.

• 8 characters is the bare MFA floor. NIST SP 800-63B-4 allows 8 only when the password is one factor inside multi-factor authentication, never on its own.
• 15 characters is the single-factor minimum. When a password stands alone, the 2025 NIST standard requires at least 15 characters.
• 16 characters protects key accounts. Email, banking, and a password manager master password warrant 16 or more characters.
• 20 or more characters suits passphrases. A four-to-six word passphrase often passes 20 characters while staying memorable.

Systems must also accept passwords up to at least 64 characters and allow spaces and any printable characters, so a full sentence or a string of words is a valid choice. The crack-time estimator above shows how each extra character pushes the time to break a password from minutes into millennia.

How Do You Build a Strong Passphrase?

A passphrase strings together several unrelated words to reach high length and entropy while staying memorable. The steps below produce one passphrase.

• Pick four to six unrelated words. Choose words with no logical connection, such as copper, lantern, gravel, and otter.
• Avoid known phrases. Confirm the words are not a quote, song lyric, or saying, because attackers test known phrases.
• Join them with a separator. Link the words with a hyphen or a space, producing copper-lantern-gravel-otter.
• Add one number and one symbol off the end. Place them at an unpredictable position inside the phrase, not only as a trailing flourish.
• Capitalize a letter inside a word. Capitalize mid-word rather than the first letter, since first-letter capitals are predictable.
• Check the length and read it aloud. Confirm the result reaches at least 16 characters and say it once to fix it in memory.

A passphrase such as copper-Lantern-gravel-otter-7! reaches 30 characters with high entropy and remains recallable. Each account still needs its own passphrase, which is where a manager becomes necessary.

What Does a Weak Password Look Like Next to a Strong One?

The two below start from the same idea but land on opposite ends of crackability.

What Should You Avoid in a Password?

Weak passwords share predictable patterns that cracking tools test first. The practices below lower password strength and should be avoided.

• Reuse across accounts. One leaked password unlocks every account sharing it through credential-stuffing attacks.
• Personal information. Names, birthdays, pet names, and addresses appear in public records and social profiles attackers harvest.
• Common substitutions. Replacing a with @ or o with 0 in a dictionary word fails, because cracking tools test these swaps automatically.
• Sequential or repeated characters. Strings such as 123456, qwerty, and aaaa sit at the top of every breached-password list.
• Single dictionary words. Any one word, in any language, falls quickly to a dictionary attack regardless of capitalization.

The most reused passwords each year, published from breach data by NordPass, include 123456, password, and qwerty. A strong password shares no pattern with these entries, and current NIST guidance tells systems to reject passwords found in breach lists.

How Do You Check If a Password Was Breached?

Checking a password against a breach database confirms whether it has already leaked and must be replaced. Have I Been Pwned holds billions of credentials exposed in known breaches.

• Open Pwned Passwords. Go to the Have I Been Pwned Pwned Passwords page in a browser.
• Enter the password. Type or paste it into the field, which hashes the entry locally before sending only a partial hash.
• Read the count. The result reports how many times the password has appeared in breaches.
• Replace any match. Change any password that returns a hit, because attackers load breached passwords into their first guesses.
• Check your email too. Enter an email address on the main page to see which breaches exposed accounts tied to it.

A password appearing even once in the database is exposed and offers no protection. The Pwned Passwords check uses k-anonymity, so the full password never leaves the browser.

How Do You Generate and Store Passwords With a Manager?

A password manager generates a random unique password for each account and stores every one in an encrypted vault, so you remember only one master password. Managers such as Bitwarden and 1Password include a built-in generator.

• Install a manager. Choose a password manager such as Bitwarden, 1Password, or KeePass.
• Set a strong master passphrase. Build it with the method above, since the master password protects the whole vault.
• Set the generator to 16 or more. Open the built-in generator and raise the length to 16 characters or higher.
• Generate one password per account. Create a unique password for each login and save it to the vault as you update accounts.
• Turn on autofill. Enable browser and mobile autofill so the manager enters each password automatically.

A generated 16-character random password reaches higher entropy than any human-made password and never repeats across accounts. The full workflow appears in the guide to using a password manager.

Strong Versus Weak Password Examples

The table compares example passwords by length, strength, and the reason each lands where it does.

How Does Password Cracking Work?

Password cracking works by testing guesses against a stolen password hash until one matches, with the number of guesses set by the password length and randomness. The methods below run in the order attackers prefer.

• Dictionary attacks run first. A cracking tool tests common words, leaked passwords, and known phrases, which makes any single word fall in seconds.
• Rule-based attacks follow. The tool applies substitutions such as a to @ and adds trailing numbers, which defeats predictable variations of dictionary words.
• Mask attacks target patterns. A guess pattern such as one capital, five letters, and two digits narrows the search when the structure is predictable.
• Brute force is the last resort. Every combination is tested in order, which only finishes in reasonable time against short passwords.

Each added character multiplies the brute-force search space, so length is the property that pushes a password beyond reach. A 16-character random password creates so many combinations that brute force becomes impractical, while a short password falls quickly regardless of symbol variety. The economics of guessing are covered in what a brute-force attack is.

How Do You Manage Passwords Across Devices?

Managing passwords across devices keeps the same unique credential available on every computer and phone without writing it down. The practices below keep access consistent and safe.

• Sync through an encrypted vault. A password manager syncs the encrypted vault to each device, so a generated password works everywhere the account signs in.
• Protect the device itself. A screen lock and device encryption stop a lost phone or laptop from exposing the vault stored on it.
• Avoid plain-text storage. A note app or spreadsheet stores passwords unencrypted, which exposes every entry if the device is compromised.
• Lock the vault when idle. An automatic vault timeout re-requires the master password, so a stepped-away device does not leave the vault open.

A password manager removes the need to memorize more than the master password, since the encrypted vault carries every other credential across devices. The device that holds the vault still needs its own screen lock and encryption, because the vault is only as accessible as the device protecting it.

What Are the Common Mistakes to Avoid?

Several habits undermine an otherwise strong password. The mistakes below recur most often when people set passwords.

• Storing passwords in a plain text file. An unencrypted note exposes every password if the device is compromised; a password manager encrypts the vault instead.
• Changing passwords on a fixed schedule. NIST advises against forced periodic changes, because they push people toward predictable variations.
• Adding only one character to an old password. Moving a password from an ending of 1 to an ending of 2 keeps it close to the breached version.
• Trusting symbol complexity over length. A short complex password is weaker than a long passphrase against offline cracking.
• Skipping a second factor. A password alone is one barrier; pairing it with two-factor authentication adds a second.

Last Thoughts on Creating a Strong Password

A strong password comes from length and unpredictability, not from a tangle of symbols. A passphrase of four to six unrelated words reaches high entropy and stays memorable, while a password manager generates and stores a unique random password for every other account. The 2025 NIST standard backs this up: it sets a 15-character single-factor minimum, requires support for 64 characters, drops forced complexity, and stops scheduled changes in favor of changing only on evidence of compromise. Checking each password against Have I Been Pwned removes any credential that has already leaked.

Because one password protects only one barrier, a strong password works best alongside two-factor authentication and an encrypted vault managed through a password manager. This guide sits in the wider set of step-by-step walkthroughs in the PC tutorials hub, which connects passwords to the other tasks every account and device relies on.

Key Takeaways:

• Favor length over complexity. A 16-character passphrase beats a short symbol-heavy password, matching current NIST guidance.
• Meet the 15-character single-factor floor. NIST SP 800-63B-4 requires at least 15 characters when a password is your only factor, and support for 64.
• Use a unique password per account. Uniqueness keeps one breach from unlocking every other login.
• Build passphrases from unrelated words. Four to six random words reach high entropy and stay memorable.
• Avoid personal information and common substitutions. Cracking tools test both before random strings.
• Let a manager generate and store them. A password manager creates random unique passwords and checks them against Have I Been Pwned.

Frequently Asked Questions (FAQs)