How to create a strong password (and remember it)

To create a strong password, make it long, random and different for every account: length matters more than symbols. The current guidance from NIST, the US standards institute, asks for at least 15 characters when the password is the only thing protecting an account, and it bars websites from forcing symbol mixes or periodic resets. To remember it, use a phrase of several random words and leave the rest to a password manager.

Then turn on two-step verification or, where it’s offered, switch to passkeys, which can’t be typed into a fake page. Below you’ll find the math we did comparing 8 characters with symbols against 4 random words, and how to check whether one of your passwords has already leaked.

What makes a password strong?

A password is strong when it’s hard to guess for a program that tries millions of options, not for a person. That comes down to three things: it’s long, it’s random rather than taken from your life (names, birthdays, your team) and you don’t use it anywhere else. Symbols help less than you’d think.

That’s why NIST requires websites to check every new password against a list of common, expected or already leaked passwords, and to reject it if it’s there. “Summer2026!” ticks every old box —capital letter, number, symbol— but it’s a common word plus a year plus a mark at the end: the first thing anyone, and any program, would try.

What matters more in a password: length or symbols?

Length. Every character you add multiplies the possible combinations, while switching from letters to letters plus symbols only widens the “alphabet” for each position. That’s why official guidance talks about length: NIST asks for at least 15 characters without a second factor, and CISA, the US cybersecurity agency, recommends at least 16.

We checked it with numbers. On October 25, 2026, we used Node.js to count the combinations for each kind of password, assuming every character or word is picked at random: raise the number of options to the power of the length (94 keyboard characters, or 7,776 words from a list like the one in the EFF’s dice method) and convert the result to bits.

Bits are a shorthand for counting: each bit doubles the options, like adding one more coin toss to guess. 52 bits is like calling 52 heads-or-tails in a row correctly. Look at the table: 15 random lowercase letters (70.5 bits) easily beat 8 characters with symbols (52.4), and 16 random characters reach almost 105.

These numbers only hold if the password is truly random, from dice or a generator. One you make up yourself has far fewer real options. And they don’t say how long cracking takes: that depends on how the website stores passwords and on the attacker’s hardware, so we don’t give times.

How do you make a passphrase you can remember?

A passphrase is several unrelated words picked at random, like “turtle lamp harvest glass”: you remember it through a mental picture, and it’s long without effort. CISA suggests 4 to 7 words, while the EFF recommends at least 6. Here’s how to build one:

1. Pick the words at random, with dice and a numbered list or with your password manager’s generator. The words that come to your mind aren’t random.
2. Use at least 5 or 6 words if the phrase protects something important, like your email or your password manager.
3. Skip sayings, song lyrics and famous quotes: they’re already known phrases.
4. Picture a scene that joins the words in order. That image is what you’ll remember.

Now the honest part of our table: 4 random words (51.7 bits) give almost exactly what 8 random characters with symbols give (52.4). Four words aren’t unbeatable; their advantage is that you can remember them, and each extra word multiplies the options by 7,776. With 6 you reach 77.5 bits without typing a single symbol.

Should you change your password every 90 days?

No, unless there’s a sign it has leaked. NIST’s 2025 guidance bars websites from requiring periodic changes and requires them to force a change only when there’s evidence the password was compromised. Changing it on a schedule doesn’t make a weak password strong; changing it after a leak does protect you.

The same fourth revision of the guidance, published in July 2025, also bans composition rules such as demanding capitals, numbers and symbols, and asks sites to accept passwords of at least 64 characters, allow pasting and let password managers work. Your bank or employer may still follow the old rules; inside their systems, theirs apply.

Why shouldn’t you reuse the same password?

Because one leaked site is enough to open all the others. If a small forum loses its database and your email uses the same password, whoever has it can try that email and password pair on your inbox, your bank and your social accounts. CISA’s advice is plain: a different strong password for each account.

Is it safe to use a password manager?

Yes, and official guidance recommends it. A manager keeps your passwords encrypted behind one master password, generates random ones and fills them in for you, so you only have to remember one. CISA notes that some are free, such as the ones built into web browsers. You probably already have one:

• Google Password Manager, in Chrome and on Android. Its Password Checkup flags passwords that are exposed, weak or used on several accounts.
• Passwords, Apple’s app since iOS 18 and macOS Sequoia, stores passwords, passkeys and verification codes and warns you if any of them shows up in a known data leak.
• Independent managers, free and paid, for when you mix brands: an iPhone and a Windows laptop, for example.

There’s no single “best” one for everyone: the built-in manager is enough if all your devices come from the same company. Whichever you choose, protect it with a long passphrase and two-step verification, because it’s the key to all the others.

What is two-step verification, and which method should you use?

It means asking for a second proof on top of your password: a code, an app approval or a physical key. Even if someone steals your password, they can’t get in without that second step. Start with your email account, because that’s where almost every other account sends its reset links.

Not every method is equal. NIST classifies codes sent by text message or phone call as a “restricted” authenticator, a less secure option that sites must back up with an alternative. Our advice: if you can choose, use an authenticator app or a security key, and save the backup codes somewhere outside your phone. A text message is still better than no second step at all.

What are passkeys?

A passkey replaces the password: you sign in with the fingerprint, face or PIN that opens your phone. According to the FIDO Alliance, which created the standard, passkeys are phishing-resistant and leave no password to steal, because you and the website share no secret.

Your fingerprint never leaves the device: Google explains that your biometric data stays on your device and isn’t shared with Google. And a passkey won’t work on a fake page, even one that copies the design and shows a padlock; the padlock only encrypts the connection, as we explain in what HTTPS guarantees and what it doesn’t. Turn passkeys on wherever a site offers them, usually in the account’s security settings.

How do you know if one of your passwords has leaked?

Search your email address on Have I Been Pwned, a service that, as of October 25, 2026, lists more than 17.8 billion breached accounts from 1,047 websites. If yours shows up, change that site’s password and any other place where you reused it. Your password manager can also warn you.

• For your email: type it into Have I Been Pwned and see which breaches it appeared in.
• For a specific password: the Pwned Passwords section checks it without it leaving your device: your browser computes a fingerprint (a hash) and sends only its first 5 characters.
• For all of them at once: Google’s Password Checkup or the security recommendations in Apple’s Passwords app.

Showing up in a breach doesn’t mean someone got into your account; it means your details from that site are out there. That’s exactly when you should change the password, and the one case where NIST says sites should make you do it.

What does this change for you and your business?

For most small businesses, the accounts that matter are few: email, bank, social media, the business WhatsApp and your website’s admin panel. For those:

• One person, one account. Sharing one password with the whole team makes it impossible to know who did what, and you have to change it every time someone leaves.
• Two-step verification on email and social media, with backup codes stored somewhere other than the phone.
• Be wary of links that ask for your password, including those behind a QR code: a QR code only holds a link, and the trap is the page it leads to.

What gets exaggerated about passwords

• “One symbol makes it safe.” A symbol at the end of a common word barely changes anything; length and randomness do.
• “A four-word passphrase is uncrackable.” In our table, 4 random words are worth about the same as 8 random characters. For anything important, use 6 or more.

The bottom line

Long, random and one per account: a 6-word passphrase for the few you need to remember, a password manager for the rest. Then add two-step verification or passkeys, and check Have I Been Pwned now and then.

And if you’d rather not create yet another account, several of the free tools on Vertize Plus work with no sign-up at all.

Frequently asked questions