Strong Passwords in 2026: Length, Passphrases, and What to Stop Doing
By Junaid Aslam. 3 min read. Updated .
Most password advice you learned is out of date. Swap a letter for a number, add an exclamation mark, change it every 90 days. Security researchers spent years showing that those habits don't help much, and some make things worse.
What 'strong' means
Call a password strong when an attacker can't guess it in a realistic amount of time. Two things drive that: how unpredictable it is, and how fast the attacker can try guesses. Unpredictability is measured in bits of entropy. Each extra bit doubles the number of guesses needed.
A few common approaches compared, assuming every character or word is chosen truly at random:
| Password type | Entropy | Notes |
|---|---|---|
| 8 random characters from 94 symbols | about 52 bits | Weak against offline attacks today |
| 12 random characters from 94 symbols | about 79 bits | Strong, hard to remember |
| 16 random letters and digits | about 95 bits | Very strong |
| 5 random words (diceware) | about 65 bits | Good, easy to type |
| 6 random words (diceware) | about 78 bits | Strong and memorable |
The word 'random' does a lot of work there. A phrase you made up yourself, like a song lyric or your pet's name plus a year, is much weaker than the table suggests, because attackers try human-style patterns first. Use a generator, not your imagination.
Length beats complexity
Adding one character to a password multiplies the guesses needed far more than swapping an a for an @. Attackers know all the usual substitutions, so P@ssw0rd! falls almost as fast as password. A longer password made of plain characters usually beats a short one full of symbols.
Passphrases: the easier way to get length
A passphrase is several randomly chosen words strung together. The well-known method is diceware: roll dice to pick words from a list of 7,776 words. Each word adds about 12.9 bits. Six words gives you about 77.5 bits, roughly the same as 12 fully random characters, but you can actually remember and type it.
The Password Generator has a passphrase mode that picks words from the EFF's long wordlist using your browser's secure random number generator. Nothing is sent anywhere. Don't reroll until you find one you like. Take what you get, or the randomness is gone.
What current guidance says
The US standards body NIST publishes widely followed guidelines for digital identity (SP 800-63B). The current direction is clear:
- Favor length. The 2025 revision sets a minimum of 15 characters when a password is the only sign-in factor.
- Don't force composition rules like 'one uppercase, one number, one symbol'. They lead to predictable patterns.
- Don't force regular password changes. Change a password when there's evidence it was exposed.
- Check new passwords against lists of known breached and common passwords.
- Allow long passwords and allow pasting, so password managers work.
The mistakes that get people hacked
Very few accounts are lost because someone brute-forced a strong password. Most are lost to these:
- Reuse. One site gets breached, and attackers try the same email and password everywhere else. This is the big one.
- Phishing. A fake login page collects the password no matter how strong it is.
- Predictable patterns. Names, birthdays, keyboard runs like
qwerty123, and 'Summer2026!'. - No second factor. A stolen password alone shouldn't be enough to get in.
A setup that works for real life
- Use a password manager. It creates and remembers a different long random password for every account, so you only memorize one.
- Make that one master password a six-word random passphrase.
- Turn on two-factor authentication for email, banking, and anything important. Passkeys and hardware keys resist phishing best. App-based codes are a solid next step. SMS codes are better than nothing.
- Check whether your email appears in known breaches (Have I Been Pwned is the standard free service) and change any passwords that were exposed.
- Skip the password rotation calendar unless a site was actually compromised.
About strength meters
The generator shows crack-time estimates from zxcvbn, an open-source estimator originally built at Dropbox. It's much smarter than a simple 'has a symbol' check, because it recognizes common words, keyboard patterns, and dates. Still, treat any estimate as a rough guide. It can't know what attackers already have, or how a given site stores passwords.
If you're not sure how a site protects your password behind the scenes, our hash guide explains why plain hashing isn't enough and what good storage looks like.