How to create a strong password?

A strong password is still one of the basic safeguards protecting your email, website, online store, social media accounts and business systems. But the rules for creating passwords have changed. Advice such as adding one capital letter, one number and one special character or changing your password every 30 or 90 days is no longer considered the best approach.

Current security guidance focuses primarily on length, uniqueness and resistance to common guessing attacks. A good password should also be easy to manage safely, which is why password managers and multi-factor authentication have become such important parts of account security.

In this guide, you will learn how long a strong password should be, whether special characters are necessary, how passphrases work, why every account needs a unique password and when you should actually change your credentials.

What makes a password strong today?

For years, users were told that a secure password had to contain uppercase and lowercase letters, digits and symbols. That advice is now incomplete. Modern recommendations put much more emphasis on password length and uniqueness.

The current NIST Digital Identity Guidelines require services using passwords as a single authentication factor to support a minimum length of 15 characters. When a password is used as part of multi-factor authentication, the permitted minimum may be shorter, although it must still contain at least eight characters. NIST also recommends allowing passwords of at least 64 characters so that users can create long passphrases.

For everyday use, a simple practical rule is to aim for at least 16 characters whenever the service allows it. This is also consistent with consumer guidance published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

A strong password should therefore be:

• long – ideally 16 characters or more;
• unique – never reused for another account;
• difficult to predict – not based on common words, names or keyboard patterns;
• unrelated to personal information that someone could discover about you;
• not present in databases of previously compromised passwords.

Important: special characters, numbers and capital letters can still be useful in randomly generated passwords. What has changed is that forcing users to add them according to a fixed pattern is no longer considered a particularly effective security measure. Attackers already know predictable patterns such as replacing “a” with “@” or adding “1!” at the end of a word.

How to create a strong password

There are two practical ways to create a secure password. You can generate a long random sequence with a password manager or create a sufficiently long passphrase that is easier to remember.

Use a randomly generated password

If you do not need to remember the password because it will be stored in a password manager, a random password is usually the simplest solution. It can contain uppercase and lowercase letters, numbers and symbols without following a predictable pattern.

An example of the format might look like this:

g7#Qm4!xL9@pR2vK8z

Do not use this particular example as a real password. Any password published in an article, documentation or social media post must be considered public.

Use a long passphrase

A passphrase consists of several words combined into one password. The words should be unrelated and selected in a way that does not create an obvious sentence, quotation or phrase.

For example, the structure could resemble:

orbit meadow coffee lantern violin

Again, do not copy this example. Its purpose is only to demonstrate the concept. A passphrase works best when its components are chosen independently and the whole phrase is long enough.

NIST specifically supports long passwords and passphrases and recommends that services accept spaces instead of forcing users to follow arbitrary character-composition rules.

Password mistakes you should avoid

Length alone does not make every password secure. A 20-character password can still be weak if it is an obvious sentence, a popular quotation or a predictable sequence.

Avoid passwords based on:

• your first or last name;
• your company or website name;
• your date of birth;
• the names of children, partners or pets;
• phone numbers or addresses;
• common sequences such as 123456 or abcdef;
• keyboard patterns such as qwerty;
• common words with predictable substitutions such as replacing “o” with “0”;
• the current year added to a company name;
• quotes, song lyrics and popular expressions.

Patterns such as Company2026! may technically satisfy a website’s requirements for uppercase letters, lowercase letters, digits and special characters, but they remain highly predictable.

This is one reason why NIST no longer recommends mandatory composition rules. Users often satisfy them in predictable ways, while the resulting password becomes harder to remember without becoming proportionally harder to guess.

Never reuse the same password

One of the most important password rules has nothing to do with the password itself. Every account should have its own unique password.

Suppose you use the same email address and password for several websites. If one of those services suffers a data breach, attackers may obtain your credentials and automatically test them against email providers, social networks, online stores and other services.

This attack is known as credential stuffing. It works because attackers do not need to crack your password again. They simply reuse credentials that have already been exposed elsewhere. OWASP identifies credential stuffing, password spraying and password guessing as common authentication threats.

Your email account deserves particular attention. Email is commonly used to reset passwords for other services, so someone who gains access to your inbox may be able to take control of additional accounts.

The same principle applies to business infrastructure. Administrative panels, CMS accounts, servers, databases, email accounts and other systems should not share credentials simply because they belong to the same person.

Use a password manager instead of memorising everything

The recommendation to create a unique, long password for every account creates an obvious problem: a person may have dozens or even hundreds of accounts.

A password manager solves this problem by generating and storing passwords for you. Instead of memorising every credential, you mainly need to protect access to the password manager itself.

A password manager makes it easier to:

• generate long and random passwords;
• use a different password for every account;
• avoid storing passwords in notes, spreadsheets or text files;
• automatically fill in login forms;
• share credentials using dedicated secure features rather than messages or email;
• replace compromised passwords more efficiently.

NIST recommends that authentication systems support password-manager functionality such as autofill and paste operations instead of deliberately blocking them. CISA also recommends password managers as a practical way to create and maintain strong, unique passwords.

Your password manager should itself be protected with a strong master password or passphrase and, whenever possible, multi-factor authentication.

How often should you change your password?

You may have seen security policies requiring passwords to be replaced every 30, 60 or 90 days. Current NIST recommendations take a different approach.

A strong password does not need to be changed just because a certain number of days has passed. Routine password changes often encourage predictable behaviour. A user may simply change Company2026! to Company2027! or rotate between a small collection of familiar passwords.

NIST therefore states that services should not force periodic password changes without a specific reason. A password should instead be changed when there is evidence that it may have been compromised.

Change your password promptly when:

• a service informs you about a security breach involving credentials;
• your password appears in a known breach database;
• you accidentally disclose or share it;
• you entered it on a suspicious or phishing website;
• you discover malware or a keylogger on your device;
• you reused the password on another account that has been compromised;
• you notice suspicious login activity.

If a reused password has been exposed, replacing it on only one website is not enough. Change it everywhere it was used and replace it with a different unique password for each service.

A password should not be your only line of defence

Even an excellent password cannot protect you from every attack. A sufficiently convincing phishing page may trick you into entering it voluntarily, while malware running on a compromised device may capture what you type.

NIST explicitly notes that passwords are not phishing-resistant. This is why account security should not end with choosing a good password.

Enable multi-factor authentication

Multi-factor authentication, usually shortened to MFA, requires another form of verification in addition to your password. Depending on the service, this may involve an authenticator app, a hardware security key, biometrics or another supported authentication method.

Enable MFA especially for:

• email accounts;
• password managers;
• banking and payment services;
• social media accounts;
• cloud storage;
• website administration panels;
• hosting and domain-management accounts;
• business systems containing customer or company data.

CISA recommends enabling MFA on every account that supports it because the additional authentication step reduces the risk that a stolen password alone will give an attacker access to the account.

Use passkeys where they are available

You may also encounter services that offer a passkey instead of, or alongside, a traditional password. Passkeys use public-key cryptography and allow users to authenticate using a device, security key or biometric verification without transmitting a reusable password to the website.

You do not need to abandon passwords everywhere immediately. However, if an important service offers a well-implemented phishing-resistant authentication method, it is worth considering as part of your security strategy.

Strong password checklist

Before you create your next account, use this short checklist:

• Aim for 16 characters or more when possible.
• Use a unique password for every account.
• Generate random passwords with a password manager when you do not need to memorise them.
• For passwords you must remember, consider a long passphrase made from unrelated words.
• Do not use names, birthdays, company names or information available on social media.
• Do not rely on predictable substitutions such as P@ssw0rd!.
• Do not reuse passwords with small changes.
• Do not change a secure password periodically without a reason; change it when compromise is suspected or confirmed.
• Use a password manager to store credentials securely.
• Enable MFA whenever it is available.
• Consider passkeys and other phishing-resistant authentication methods on services that support them.

How to create an effective password – summary

The definition of a strong password has evolved. Security no longer comes from mechanically adding a capital letter, a number and an exclamation mark. Length, uniqueness and unpredictability matter more.

For everyday accounts, aim for passwords of at least 16 characters where possible, never reuse them and let a password manager generate and store random credentials. If you prefer something memorable, use a long passphrase based on unrelated words rather than personal information or a familiar quotation.

Finally, remember that even a very strong password is only one part of account security. Enable MFA and use phishing-resistant authentication methods such as passkeys where they are available. Protecting your accounts is particularly important when they control your website, domain, email or other parts of your digital business.

A secure online presence also depends on the technology behind your website. Explore the cyber_Folks technology ecosystem and discover solutions supporting businesses at different stages of their online growth.