Write a Strong Password in 2026: Security Researcher Rules

If you are old enough to remember AOL, you were probably taught that a strong password is at least eight characters, mixes uppercase and lowercase letters, includes a number, and has a special symbol. Something like "Tr0ub4dor&3". It has capital letters, numbers, symbols, a poster child for a strong password.

Security researchers now say that advice was a mistake. Bill Burr, the man who wrote the original 2003 NIST guidelines that popularised it, told the Wall Street Journal in 2017 that the whole thing was wrong. "It just annoyed people and did not make it much harder to crack."

This is what the modern advice actually says.

What actually makes a password strong

The strength of a password has one primary factor: entropy, a mathematical measure of how unpredictable it is. Entropy is measured in bits. A password with 40 bits of entropy has 2^40 possible values (about 1 trillion). A password with 80 bits has 2^80 (about 1 sextillion).

Attackers do not guess passwords character by character. They use dictionaries of common passwords, leaked password lists, and rules-based transformations ("try all dictionary words with capitalised first letter and a number at the end"). A password like "P@ssw0rd1" looks complex but is trivially cracked because it is a well-known base word with predictable transformations.

Notice that the "long random string" and "four random words" have similar entropy but the four random words are far easier to remember. This is the key insight of modern password advice: length beats complexity, and a password you can remember but that an attacker cannot guess is the right answer.

The new rules (from NIST SP 800-63B)

NIST is the US National Institute of Standards and Technology. Its Special Publication 800-63B is the current standard for how passwords should be handled, and it directly contradicts most of what you were taught:

• Minimum length should be 8 characters, and ideally 15 or more. Length is the priority.
• Maximum length should be at least 64 characters. No site should reject a 64-character password.
• Do NOT require a mix of character types. Uppercase, lowercase, numbers and symbols can all be optional.
• Do NOT force password expiration. Changing passwords every 90 days makes users pick weaker passwords.
• Do NOT use password hints or knowledge-based security questions. Both are insecure.
• DO check passwords against known-breached lists. If your password appears in a breach dump, reject it.
• DO allow paste into password fields. It encourages password managers.
• DO allow any printable ASCII character, including spaces.

The reasoning behind each of these is empirical. Forced password changes cause people to increment the number at the end ("password1" becomes "password2" becomes "password3"), which is trivially predictable. Complexity requirements cause people to use the same pattern everywhere ("CompanyName2024!"), which fails catastrophically when one site is breached.

What to actually do

The practical rules, in priority order:

1. Use a different password for every account

This is the single most important rule. If you use the same password on your email, your bank and a random forum, then a breach at the forum exposes your email and bank too. Attackers call this "credential stuffing." They take leaked email/password combinations from one site and try them on every other site.

A unique password per account means a breach at any one site only compromises that site. The other 50 accounts remain secure.

2. Use a password manager

You cannot remember 60 unique strong passwords. Nobody can. Use a password manager: Bitwarden (free), 1Password (paid), Dashlane (paid), or the built-in managers in Chrome, Safari and iOS Keychain.

The manager stores all your passwords encrypted with one master password. You memorise the master password. The manager does the rest. Auto-fill makes it faster to log in to sites than typing a password manually, and it eliminates the temptation to reuse.

If you use only one security tool, make it a password manager.

3. Make passwords long, not complicated

A four-word passphrase like "purple-ridge-tapir-violin" is stronger than a 10-character "P@ssw0rd99" and infinitely easier to remember. Length beats complexity. Aim for 16 characters minimum, or four random words.

4. Enable two-factor authentication everywhere

Even a strong password can be phished or leaked. Two-factor authentication (2FA) adds a second layer, usually a code from your phone, that an attacker cannot easily replicate.

Priority order for 2FA:

1. Hardware security keys (YubiKey, Titan). Most secure. Nearly phishing-proof.
2. Authenticator apps (Google Authenticator, Authy, 1Password). Very secure, easy.
3. SMS codes. The weakest 2FA. Vulnerable to SIM-swap attacks, but still much better than nothing.

Enable 2FA on your email first. Email is the recovery method for everything else, so it is the highest-priority target. Then your bank, then your main social accounts.

5. Never reuse, never write down, never share

Every "I write my passwords in a notebook" story ends the same way: the notebook is lost, or photographed, or the house is broken into. And "I use the same password everywhere so I do not forget" is worse, because a breach at one site exposes all of them.

How to generate a strong password right now

A password generator creates random passwords using your device's cryptographic random number generator, the same source of randomness your browser uses for TLS.

1. Open the Password Generator tool.
2. Choose your settings: length (aim for 16 or more), character types (all of them).
3. Click Generate. The password appears.
4. Copy it and save it in your password manager.

What not to do

• Do not use personal information. Names, birthdays, pets, addresses, phone numbers. All easily discovered. Attackers try these first.
• Do not use dictionary words on their own. Modern cracking tools test every English word, plus common substitutions (a to @, e to 3, i to 1).
• Do not use patterns on the keyboard. "qwerty", "123456", "zxcvbn" are on every leaked password list.
• Do not use the same password with small variations across sites. "MyPass-Google", "MyPass-Facebook" is only marginally better than reusing exactly.
• Do not update passwords "every 90 days" unless you have a specific reason. Modern research shows this makes passwords worse, not better.
• Do not share passwords over email, chat, or SMS. If you must share one, use a one-time secret link (Bitwarden Send, 1Password's sharing features).

What to do if your password is in a breach

Check haveibeenpwned.com. It is a free service that tells you which breaches your email address appears in. If your password for a breached site was unique and only used there, change it on that site and you are done. If you used that password anywhere else, change it everywhere immediately.

The order of operations after a breach:

1. Change the password on the breached site to something new and unique.
2. Change that same password on every other site where you used it.
3. Enable 2FA on your email account if you have not already.
4. Check your email account for suspicious logins or forwards. If attackers have email access, they can reset everything else.
5. Consider a credit freeze if any financial information was exposed.

The bottom line

The old advice was wrong. Complex short passwords are hard to remember and easy to crack. Modern advice is simpler: use a password manager, generate long random passwords for every account, and enable two-factor authentication on your email.

If you do nothing else today: install a password manager. It is the single biggest improvement to your security you can make, and it makes your digital life faster, not slower.