How to create a strong password in 2026

The advice you grew up with - swap an "a" for an "@", add a number, capitalise the first letter - is mostly wrong. Here is what actually makes a password hard to break, and a method you will remember.

For two decades, "complexity" ruled password advice: throw in a symbol, a digit, a capital, and you were told you were safe. The problem is that humans are predictable. We capitalise the first letter, put the number at the end, and reach for the same handful of symbols. Attackers know this, and their software accounts for it.

What machines genuinely struggle with is not complexity - it is length combined with unpredictability. Every extra character multiplies the number of guesses an attacker must make. That single idea is the foundation of every recommendation below.

The one rule that matters most: length

A password's resistance to brute-forcing is measured in entropy - roughly, the number of guesses needed to find it. Entropy grows with both the size of the character pool and, far more powerfully, the length of the password. Adding one symbol nudges the pool. Adding four more random characters multiplies the work by thousands.

Consider this: an 8-character password drawn from 95 possible characters has about 52 bits of entropy. A modern GPU cluster can exhaust 52 bits in under an hour. But a 16-character password from the same character set has 105 bits of entropy - a number so large that cracking it would take millions of years with today's technology. Every additional character doubles the search space, and that exponential growth is what makes longer passwords so much more secure than shorter ones, regardless of complexity tricks.

The first looks "complex" but is short and based on a dictionary word with predictable substitutions - software guesses it in moments. The other two are far longer, and that length is what makes them practically unbreakable. The lesson is clear: when it comes to passwords, length trumps complexity every time.

Two methods that actually work

1. The random string (best for accounts you do not type often)

For your email, bank, and password manager, use a long, fully random string and let software remember it. There is no need to memorise it if a password manager stores it for you. This is exactly what a generator is for - maximum entropy, zero human predictability. A 20-character random string with full character variety provides over 130 bits of entropy, making it impervious to any known cracking technique.

2. The passphrase (best for the few you must memorise)

For the handful of passwords you genuinely have to recall - like the master password to your manager - string together four or more random, unrelated words. The key is that the words must be chosen randomly from a large dictionary, not creatively selected by you. A five-word passphrase drawn from a 7,776-word dictionary provides about 64 bits of entropy, which is strong enough for most purposes while being far easier to type and remember than a random string of characters.

• Pick words at random, not a phrase that means something to you ("ilovemydog" is weak because it follows an emotional pattern).
• Separate them with symbols or numbers to widen the character pool: otter-Velvet7-cobalt-Drum
• The randomness is what counts. A quote from your favourite film is not random - it is in a database somewhere and will be tested early in any cracking attempt.
• Aim for at least four words, but five or six is better for critical accounts like your password manager master password.

Mistakes that quietly undo everything

• Reusing passwords. One breach then unlocks every account. This is the single most common cause of account takeover, and it is entirely preventable with a password manager.
• Personal information. Birthdays, pet names, and street names are the first things tried by attackers who have done their reconnaissance on social media.
• Tiny tweaks. Changing "Summer2025" to "Summer2026" fools no one. Attackers' dictionaries include all common date and number patterns.
• Keyboard patterns. "qwerty", "1qaz2wsx" and similar patterns are all in the cracking dictionaries and will be tested within milliseconds.
• Using the same password across personal and work accounts. A breach of a low-value personal account can cascade into a full compromise of your work credentials if you reuse passwords.

Put it into practice now

You do not need to invent randomness in your head - humans are famously bad at it. Use the generator to forge a maximum-entropy password, then paste anything you already use into the checker to see how it really holds up. Start with your most critical accounts: email, banking, and your password manager itself. Replace any password that is under 12 characters, contains personal information, or has been reused elsewhere. With a password manager handling storage and autofill, you can upgrade every account to a strong, unique password in a single afternoon.

Remember that password security is not a one-time task. As new breaches are discovered and cracking technology advances, periodically review your password strength and update as needed. Services like NordPass make this easy with automated health scans and breach monitoring. By combining a strong password generator, a password manager, and multi-factor authentication, you create a layered defense that protects your digital identity against both current and emerging threats.

Building Long-Term Password Habits

Good password security is not achieved through a single effort but through consistent habits maintained over time. Start by auditing your existing passwords and replacing any that are weak, reused, or exposed. Make it a routine to use your password generator for every new account you create. Set aside time every quarter to review your password health and address any issues. Over time, these habits become automatic, and the effort required to maintain strong security decreases while the benefits accumulate. The alternative - waiting for a breach to force change - is far more costly in terms of both money and stress.

Educating family members or team members about password security multiplies the effectiveness of your efforts. A chain is only as strong as its weakest link, and in password security, the weakest link is often someone who does not understand the risks or does not know how to create strong passwords. Share what you have learned about password generators, entropy, and password managers with those around you. By spreading good password habits, you create a community of security-conscious users who reinforce each other's good practices and reduce the overall risk for everyone involved.

Staying Informed About Password Security

The password security landscape evolves continuously as new attack techniques emerge and defensive best practices advance. Following reputable security sources, enabling automatic updates for your password manager, and reviewing your password health dashboard regularly will help you stay ahead of threats. Many password managers now include educational resources and security news features that keep you informed without requiring additional effort. By combining a strong password generator, a password manager, and ongoing security awareness, you create a dynamic defense that adapts to the changing threat landscape.