How to create a strong password: what NIST recommends today
Old advice told us to swap letters for symbols and change passwords every few months. Current guidance from NIST, the US standards body, says something different.
What NIST recommends
- Length first. Passwords chosen by users must be at least 8 characters, and 15 is recommended when a password is the only login factor. Systems should allow at least 64 characters.
- No forced complexity rules. Services should not require a mix of uppercase, numbers and symbols.
- No routine expiry. Change a password when there is evidence of a problem, not on a calendar.
- Block known-bad passwords. New passwords should be checked against breached and common lists.
- Allow paste. Pasting must work so password managers can be used.
How strong is a random password?
If each character is picked at random from the 94 printable ASCII characters, every character adds about 6.55 bits of strength. A 12-character password is about 79 bits, and a 16-character one about 105 bits. Each extra bit doubles the guesses needed.
Skip the maths, try your own numbersPassword GeneratorFree, instant, no sign-up →Practical rules
- Use a different password for every account, so one breach cannot open the others.
- Let a password manager create and store them.
- For passwords you must remember, use a long passphrase of several unrelated words.
- Turn on multi-factor authentication for email, banking and your password manager.
Generate a random password below. It is created in your browser and never stored or sent anywhere.
Why length beats complexity
Attackers do not guess by hand. They use software that tries billions of combinations and lists of leaked passwords. Each extra character multiplies the number of guesses needed. A long random password is far harder to crack than a short one with symbols, and a "clever" substitution such as P@ssw0rd is in every attacker's list.
Password strength by length (random, 94 characters)
| Length | Approximate strength |
|---|---|
| 8 characters | 52 bits |
| 12 characters | 79 bits |
| 16 characters | 105 bits |
| 20 characters | 131 bits |
The strength applies only when characters are chosen truly at random. A password you invent yourself is usually much weaker than its length suggests.
Passphrases you can remember
A passphrase made of random words is easier to remember. If you pick words at random from a list of 7,776 words, each word adds about 12.9 bits, so a 5-word passphrase has about 65 bits and a 6-word one about 78 bits. The words must be chosen by a random process, not from a song lyric or a quote. Use a passphrase for the few things you must type from memory, such as your password manager and your device login.
Why you need a password manager
Nobody can remember dozens of unique random passwords. A password manager creates, stores and fills them for you, so every account gets a different one. If one site is breached, the others are safe. Protect the manager itself with a strong passphrase and multi-factor authentication.
Multi-factor authentication and passkeys
A second factor stops most account takeovers even if a password leaks. Prefer an authenticator app or a hardware key to SMS codes where possible. Passkeys replace the password with a cryptographic key stored on your device and unlocked by your fingerprint, face or PIN. They resist phishing and are supported by a growing number of services. Use them where offered.
What to do after a breach
- Change the password for that site immediately.
- Change it anywhere else you reused it.
- Turn on multi-factor authentication.
- Watch for phishing emails that use leaked details.
You can check whether your email appears in known breaches on the Have I Been Pwned website.
Common password mistakes
- Reusing one password across sites.
- Using names, birthdays or pet names.
- Adding a number at the end to meet a rule.
- Sharing passwords by message.
- Writing them in an unprotected note.
Is an online password generator safe?
This generator runs in your browser and creates the password on your device using the browser's secure random number generator. Nothing is sent or stored. Copy the password into your password manager straight away.
Troubleshooting: common problems and fixes
- A site rejects my long password. Some sites still cap length. Use the longest allowed and tell the site if you can.
- Special characters are not accepted. Use a longer password with letters and numbers instead.
- I forgot my password manager password. Use your recovery method. Write the passphrase down once and store it safely.
- I use the same password everywhere. Change the important ones first: email, banking and your password manager.
- I think an account is hacked. Change the password, sign out of all devices and turn on multi-factor authentication.
Is the password generator safe?
The generator runs in your browser and uses the secure random number generator built into it. Passwords are not stored, logged or sent. Copy the password straight into your password manager, and do not share it by email or chat.
More free Zyphub tools you may need
- Password Generator: Strong random passwords.
- QR Code Generator: QR codes for links and text.
- Word Counter: Words, characters and reading time.
Frequently asked questions
How long should a password be?
NIST requires at least 8 characters for user-chosen passwords and recommends 15 or more when the password is the only factor. For random passwords, 16 or more is a good habit.
Do I need special characters and numbers?
Not necessarily. NIST advises services not to force composition rules. Length and uniqueness matter most, though random characters add strength per character.
Should I change my password every few months?
Not on a schedule. Change it if you suspect it has been exposed or after a breach.
Is a passphrase better than a random password?
A random passphrase of five or six words can be both strong and memorable. For accounts stored in a password manager, a long random password is best.
What is a passkey?
A passkey is a phishing-resistant login that uses a key on your device, unlocked by biometrics or a PIN, in place of a password.
Is a 12-character password enough?
A random 12-character password is strong against most attacks, but 16 or more is better for important accounts.
Should I use a password manager?
Yes for most people. It lets you use a unique strong password for every account.