How to Create a Strong Password That Actually Protects You

For years we were told to mix uppercase, numbers and symbols and change passwords every 90 days. The result was passwords like Summer2024!, easy for attackers to guess and hard for people to remember. Security guidance has changed. Here is what actually makes a password strong today, with the numbers behind it.

Length matters more than complexity

Attackers don't guess one password at a time by hand. They use software that tries billions of combinations, starting with leaked passwords, dictionary words and common patterns like a capital letter at the start and "!" at the end. Each extra character multiplies the number of possibilities, so length is the single most effective defense.

The current U.S. NIST guidelines (SP 800-63B, revision 4, finalized in 2025) reflect this. They call for at least 15 characters when a password is the only thing protecting an account, tell websites to accept at least 64 characters, and drop forced composition rules and routine password changes. Instead, sites should block passwords that appear in known breach lists.

Password strength in numbers (entropy)

Security experts measure strength in bits of entropy: the number of yes/no guesses needed to cover every possibility. Each extra bit doubles the work for an attacker. For a truly random password, entropy = length × log₂(number of possible characters).

Password type	Example	Entropy
8 random characters (all 94 printable)	k#9Tz!qV	≈ 52 bits
12 random characters	r7&Lm2^xQe9!	≈ 79 bits
16 random characters	W4p!s9@Ld2#zQm7&	≈ 105 bits
5 random words (Diceware list)	orbit-candle-mosaic-tulip-grain	≈ 65 bits
6 random words	orbit-candle-mosaic-tulip-grain-fable	≈ 78 bits

As a rough guide, aim for at least 70–80 bits for important accounts. A 16-character random password or a six-word passphrase gets you there.

Entropy only applies to passwords chosen randomly. "Password123!" is 12 characters long, but it is among the first guesses any cracking tool tries, so its real strength is close to zero.

Random password or passphrase?

• Random characters are the strongest per character. Use them for anything stored in a password manager, because you never need to type or remember them.
• Passphrases (several random, unrelated words) are easier to remember and type. Use them for the few passwords you must memorize: your password manager's master password, your computer login and your main email.

The words must be chosen randomly (by dice or a generator), not picked by you. A favorite song lyric or a famous quote is not random.

Five rules that matter most

1. Use a different password for every account. When one site leaks, attackers try the same email and password everywhere else ("credential stuffing").
2. Use a password manager. It generates, stores and fills unique passwords so you only remember one.
3. Turn on two-factor authentication (2FA), preferably with an authenticator app or a hardware key rather than SMS.
4. Switch to passkeys where offered. Passkeys replace passwords with cryptographic keys stored on your device and can't be phished.
5. Change a password when there is a reason, such as a breach notice, not on a fixed calendar.

What to avoid

• Names, birthdays, pets, sports teams and addresses: they are easy to find on social media.
• Keyboard patterns like qwerty, 1q2w3e or asdfgh.
• Predictable substitutions such as P@ssw0rd; cracking tools test these automatically.
• Adding a number to an old password (password1 → password2).
• Saving passwords in a notes app, a spreadsheet or an email to yourself.

How our password generator works

The CoringaWeb password generator creates passwords in your browser using its built-in cryptographic random number generator. Nothing is sent to a server. Choose the length (16 or more is a good default), pick the character types the site allows, generate and copy it straight into your password manager.

Frequently asked questions

How long should a password be in 2026?

At least 15 characters for accounts protected by a password alone, and 16 or more random characters if it is stored in a password manager. Passphrases of five or six random words are a good choice for passwords you need to remember.

Are passphrases safer than complex passwords?

A passphrase of six random words is about as strong as a 12-character random password and much easier to remember. Both are far stronger than a short password with symbols.

Should I change my passwords regularly?

Current guidance says no. Change a password when there is evidence it was exposed, and use a unique password for every account.

Is it safe to use an online password generator?

It is safe when the password is generated locally in your browser and never sent to a server, as with the CoringaWeb generator.

Informational content only. For legal, financial or health decisions, consult a qualified professional.