How to Create a Strong Password

Modern password guidance puts much more weight on length and uniqueness than on forcing a particular mix of uppercase letters, numbers and symbols. The goal is a password that is hard to guess, different for every account, and easy to manage safely.

A good baseline: long and unique

• Aim for at least 15 characters when a service allows it. Current NIST guidance requires services using passwords as a single authentication factor to set a 15-character minimum.
• Use a different password for every account. Reuse is one of the biggest practical risks: one breached password can otherwise unlock several accounts.
• Long passphrases are fine. Several unrelated words can be easier to remember and still give you useful length.
• Do not rely on predictable “complexity tricks.” Turning password into Password1! satisfies many old rules but remains easy to guess.

You do not need to force complexity yourself

NIST's current guidance tells services not to impose composition rules such as “must contain one uppercase letter, one digit and one symbol.” Those rules often lead people to make predictable changes rather than genuinely stronger passwords. If a website requires a symbol or number, of course you must meet its rule; just do not mistake the rule itself for security.

A password manager-generated password may contain letters, digits and symbols because it is random. That is excellent. The important point is that randomness, length and uniqueness matter more than manually following a recipe.

The easiest strong strategy: use a password manager

• Let the manager generate a long, unique password for each site.
• Protect the password vault with one strong master passphrase that you do not reuse anywhere else.
• Turn on multi-factor authentication for the password manager itself.
• Keep recovery codes somewhere secure and separate from the device you normally use to sign in.

If you need to remember a password yourself

Use a long passphrase made from unrelated words rather than a short word with obvious substitutions. Avoid names, birthdays, pets, teams, addresses, or phrases that someone could learn from your social media. Do not use the same “base password” with a different site name attached to the end; once an attacker sees one version, the pattern is easy to predict.

Do not change passwords on a fixed schedule

Routine password changes every 30, 60 or 90 days are no longer considered good general practice. Change a password when you have evidence or a credible reason to think it was exposed, when a service reports a breach affecting it, or when you accidentally reused or shared it. Otherwise, keep the strong unique password and avoid creating a weaker replacement just because the calendar says so.

Add protection beyond the password

• Use multi-factor authentication (MFA). An authenticator app or hardware security key adds protection if a password is stolen. SMS is generally better than having no second factor, though it is less resistant to some attacks.
• Use passkeys where available. Passkeys remove the need to type a reusable password and are designed to resist ordinary phishing attacks.
• Keep recovery methods current. Make sure your recovery email, phone number and saved recovery codes are still under your control.

What to do after a breach

1. Change the affected password immediately.
2. If you reused it anywhere else, change every reused copy.
3. Sign out other sessions if the service offers that option.
4. Enable MFA or a passkey.
5. Watch the account for unfamiliar activity and review recovery settings.

Quick password checklist

• 15+ characters when possible.
• Unique to that account.
• Generated and stored by a password manager when practical.
• No personal information or predictable site-specific pattern.
• No unnecessary periodic changes.
• MFA or passkey enabled on important accounts.

Last reviewed: August 2026 · Updated to reflect NIST SP 800-63B-4 password guidance