A strong password is one an attacker cannot guess quickly. Predictable patterns are the main weakness, not a missing symbol.
Entropy in plain terms
Password strength is often described in bits of entropy: length × log₂(number of possible characters). Twelve characters drawn at random from about 94 printable characters give roughly 78 bits. Sixteen random lowercase letters give about 75 bits, nearly as much, because length adds strength fast.
Random beats clever
People pick substitutions like "P@ssw0rd" that attackers already try. A password only gets its calculated strength when each character is chosen at random. A generator that uses your browser's cryptographic random source is better than anything you invent yourself.
Use a different password for every account
If one site is breached, reused passwords let attackers try the same login elsewhere. A reputable password manager makes unique long passwords practical, since you only remember one strong master password.
Add a second factor
Turn on two-factor authentication where available, preferably with an authenticator app or a security key. It protects you even when a password leaks.
Passphrases
Several unrelated random words can be both strong and memorable. Choose them randomly rather than picking a quote or lyric.
How attackers actually get in
Guessing is only one route. Attackers try passwords leaked from other sites, run through lists of common passwords, or trick people with fake login pages. A long random password defeats guessing but not phishing, which is why checking the web address and using two-factor authentication still matter.
Passphrases by the numbers
If you choose six words at random from a list of 7,776 words, each word adds about 12.9 bits, for roughly 77 bits in total. That is comparable to a 12-character random password and much easier to remember. The words must be chosen by a random process, not by you.
How long should a password be?
For accounts you type often, such as a password manager master password, a random passphrase of five or six words is a good option. For everything else, let a manager store a random password of 16 characters or more, since you never need to type it.
Do I need to change passwords regularly?
Current guidance from NIST in SP 800-63B recommends against forcing periodic changes with no reason, because it leads people to make weaker, predictable edits. Change a password when you have reason to believe it was exposed.
Protect your recovery routes
A strong password is undermined if the email account used for resets is weak. Secure that account first, save any recovery codes somewhere safe, and keep your phone number and recovery email current.
Try the calculators
This guide is for general information only. It is not financial, medical, or legal advice.