How to Choose a Password That's Actually Strong

Most password advice is a decade out of date. “At least eight characters with a capital, a number and a symbol, changed every 90 days” produced a generation of passwords like Summer2026! — which satisfies every rule and is among the first things any attacker tries. Here’s what actually matters.

How passwords get broken

Almost nobody guesses passwords by typing them into a login form; rate limiting makes that hopeless. Real attacks work offline:

1. A site gets breached and its database of password hashes is stolen.
2. The attacker runs the hashes through cracking software on a GPU rig — billions of guesses per second for fast hash functions.
3. Guesses come from wordlists first: every password from previous breaches (billions of real ones), dictionary words, names, dates, and every common substitution (a→@, o→0, s→$, a number and exclamation mark on the end).
4. Brute force is the last resort, and only viable for short passwords.

Two conclusions follow. First, anything derived from a word, name or date falls in the wordlist stage no matter how you decorate it. Second, if your password is genuinely random, only brute force applies — and then only its length and character set matter.

Entropy, in plain terms

Entropy measures how many equally likely passwords the generator could have produced, expressed in bits. Each extra bit doubles the number of possibilities.

entropy = length × log₂(size of character set)

Password style	Character set	8 chars	12 chars	16 chars	20 chars
Lowercase only	26	38 bits	56 bits	75 bits	94 bits
Lower + upper + digits	62	48 bits	71 bits	95 bits	119 bits
All printable + symbols	95	53 bits	79 bits	105 bits	131 bits

Rough guide: under 50 bits is crackable quickly, 60–70 bits resists casual attacks, 80+ bits is beyond brute force with current and foreseeable hardware.

Look at the table again and notice the pattern: 20 random lowercase letters (94 bits) beat 12 characters with every symbol type (79 bits). Adding length is cheaper and more effective than adding complexity — and much easier to type on a phone.

What the current guidance says

The US standards body NIST rewrote its password guidance (SP 800-63B) around a few principles that most security teams now follow:

• Length matters most. Allow long passwords — at least 64 characters — and don’t restrict which characters people use.
• Stop forcing periodic changes. Rotation every 90 days makes people pick weaker, patterned passwords (Spring2026! → Summer2026!). Change a password when there’s a reason: a breach, or a suspicion.
• Stop demanding composition rules. “Must contain a symbol” reliably produces Password1! and little else.
• Check against breach lists instead — reject passwords known to be compromised.

If your workplace still enforces 90-day rotation, that’s policy inertia, not security.

Passphrases: for the ones you must remember

You should only need to memorise two or three passwords: your device login, your password manager, and maybe your email. For those, a passphrase of randomly chosen words is the right tool.

Pick words randomly — with dice or a generator, never by thinking of them, because human choice is heavily patterned. From a 7,776-word list (the standard Diceware list), each word adds about 12.9 bits:

• 4 words ≈ 52 bits — adequate for low-stakes use
• 5 words ≈ 65 bits — a good master password
• 6 words ≈ 77 bits — strong
• 7 words ≈ 90 bits — paranoid, and still easier to type than 15 random characters

correct horse battery staple is the famous example. The strength comes entirely from the words being random; my name is salman has essentially none.

The system that actually works

1. Use a password manager. Bitwarden, 1Password, KeePass, or the one built into your browser. It generates a long random password per site and fills it for you.
2. One strong passphrase guards the manager. Memorise that one; write it down and store it somewhere physically safe if you need to.
3. Turn on two-factor authentication for email, banking and anything financial. An authenticator app or a passkey beats SMS, which can be intercepted by SIM swapping. Even a weak password with 2FA usually survives.
4. Never reuse passwords. Reuse is what turns one site’s breach into your email being taken over. A manager makes this effortless.
5. Check haveibeenpwned.com for your email address; change anything it flags.

Passkeys are replacing all of this

The direction of travel is away from passwords entirely. A passkey stores a private key on your device, unlocked by your fingerprint, face or PIN, and proves your identity cryptographically to the site. Nothing is typed, so nothing can be phished, guessed or leaked in a breach. Apple, Google and Microsoft all support them, and adoption is growing quickly.

Where a site offers passkeys, use them. Until every site does, the manager-plus-passphrase system above is the practical answer.

Need one now? The password generator creates passwords in your browser using the operating system’s cryptographic random source, shows the entropy in bits as you adjust the settings, and never transmits or stores what it makes.