Security
What makes a strong password in 2026 — and what doesn't
What makes a strong password in 2026 — and what doesn't
Table of contents
If you still believe that adding a number and an exclamation mark to your dog's name makes a strong password, this guide is for you. Modern guidance is simpler than the old rules, and a lot harder to crack.
The new rules, in one sentence
Length beats complexity. A 16-character random string is dramatically harder to crack than an 8-character "P@ssw0rd!" — and easier to generate.
Why the old rules are dead
For two decades, security advice told us to mix uppercase, lowercase, numbers and symbols. The result was predictable: people picked Password1! and reused it everywhere. Attackers learned the patterns faster than humans could invent them.
The 2024 update to NIST SP 800-63B formalised what researchers had been saying for years: focus on length, screen against known breached passwords, and stop forcing periodic changes that lead to weaker passwords.
Three things to do today
1. Use a password manager
A password manager lets every account have a unique 20-character random password without you needing to remember any of them. Pick any reputable manager and turn it on.
2. Generate, don't invent
Use a generator — like the one on this site — to create random passwords. Our Password Generator runs entirely in your browser, so the password is never transmitted anywhere.
3. Enable two-factor authentication
For your email, your bank and any account that touches money, turn on 2FA. Hardware security keys are the strongest option; authenticator apps are a great second choice.
How long is long enough?
- 12 characters: minimum for low-risk accounts.
- 16 characters: a good default for everything.
- 20+ characters: for email, banking and password-manager master passwords.
Common myths
"I have to change my passwords every 90 days." — No. Change them when there is a sign of compromise.
"Adding a symbol makes any password strong." — No. P@ssw0rd! is one of the first guesses attackers try.
Ready to upgrade? Open the Password Generator and create a fresh 20-character password for your email account right now.
Keep reading