How to create a strong password

Length beats complexity

For years, sites told us to mix upper case, numbers and symbols, and to change passwords every 90 days. The result was passwords like Summer2024!: technically "complex", easy to guess, and among the first things an attacker tries.

Current guidance says the opposite. The US National Institute of Standards and Technology's digital identity guidelines, NIST SP 800-63B (revision 4, 2025), tell services to:

• require at least 15 characters for a password used on its own, and at least 8 when it is only one part of multi-factor login;
• allow passwords of at least 64 characters, including spaces;
• not impose composition rules such as "one symbol and one number";
• not force regular changes, only a change when there is evidence of a breach;
• check new passwords against lists of common and leaked passwords;
• allow password managers, autofill and pasting.

Those rules are written for the companies running logins, but the lesson for you is simple: long and random wins. Adding one random character multiplies the work for an attacker far more than swapping an a for an @.

Entropy, explained simply

Entropy measures how many guesses it takes to be sure of finding a password, written in bits. Each extra bit doubles the number of guesses. It only applies to passwords that were picked at random. A password you invent has far less entropy than it looks, because attackers try words, names, dates and keyboard patterns first.

"All types" means the 94 printable keyboard characters. Words come from the EFF large word list of 7,776 words, about 12.9 bits each. The guess rate is an illustration of a fast offline attack on a stolen password database; real speeds vary hugely with how the site stored your password. An attacker would usually find it in half the time shown.

Passphrases: strong and easy to type

A passphrase is a handful of words chosen at random, such as Gravel-Unfold-Pastry-Ozone-Tulip. It is long, easy to read out and type on a phone, and memorable enough for the few passwords you must keep in your head: your password manager, your computer login and your main email.

• Use five or six words for anything important.
• Let a dice roll or a generator pick them. A phrase you choose ("ilovemydog") is a guessable phrase, not a passphrase.
• Separators, a capital and a digit are fine but optional. The randomness of the words is what counts.

Password Generator picks words from the EFF list using your device's cryptographic random number generator and shows the real entropy of each result.

Use a password manager and two-factor login

Nobody can remember 100 strong, unique passwords, and you should not try. The biggest real-world risk is reuse: when one site leaks, attackers try the same email and password everywhere else.

1. Pick a password manager. The ones built into your phone and browser are a good start; dedicated apps add sharing and cross-platform sync.
2. Protect it with a passphrase of six random words that you use nowhere else.
3. Change reused passwords first, starting with email, banking and shopping accounts.
4. Turn on two-factor authentication. An authenticator app or a passkey is stronger than SMS codes, but any second factor beats none.
5. Save recovery codes somewhere safe and offline.

How to check if a password has leaked

Have I Been Pwned keeps a list of hundreds of millions of passwords found in breaches. Checking a password against it sounds risky, but the range search uses a method called k-anonymity:

1. Your device turns the password into a SHA-1 hash, a 40-character fingerprint.
2. Only the first 5 characters of that hash are sent.
3. The service replies with every leaked hash that starts with those 5 characters, typically hundreds of them.
4. Your device looks for a full match locally. The service never learns the password or even which hash you were checking.

The checker in Password Generator works this way, and also flags common passwords, names, dates and keyboard patterns before anything is sent. If a password shows up, stop using it everywhere.

Common mistakes

• Reusing a password, even a strong one, across sites.
• Predictable patterns: a word plus a year plus "!", or Qwerty123.
• Personal details: pets, children, birthdays and football teams are easy to find online.
• Small tweaks when forced to change: Password1 to Password2.
• Storing passwords in plain notes or emailing them to yourself.
• Skipping two-factor login on your email, which can reset everything else.