How to create a strong password

Almost everything commonly taught about strong passwords is out of date. Swapping "a" for "@", demanding a symbol, and forcing a change every 90 days are rules from the 2000s that now do more harm than good. What actually protects you is something else — and it can be measured.

The right measure: entropy, not "complexity"

Password strength is measured in bits of entropy: how many attempts an attacker would need, on average, to hit it. The formula is simple:

entropy = length × log₂(alphabet size)

An alphabet of lowercase letters and digits has 36 symbols; with capitals and punctuation it reaches 95. But look at what the formula says: alphabet size enters through a logarithm, while length enters as a multiplier. In other words, each extra character is worth far more than any special symbol.

How long each password holds out

The table assumes an offline attacker able to test 100 billion guesses per second — realistic for dedicated hardware against a database leak with weak hashing.

Password	Entropy	Time to crack
8 characters, lowercase and digits	41 bits	28 seconds
8 characters, full keyboard	53 bits	under a day
4 random words	52 bits	under a day
5 random words	65 bits	about 9 years
12 characters, full keyboard	79 bits	170,000 years

Two uncomfortable conclusions jump out. First: eight characters is not enough, however much of the keyboard you use. Second: four random words is not enough either — the popular "just use three or four words" advice has aged out, and the current floor is five.

The rule that matters more than strength

Here is the point that changes everything, and that almost no guidance stresses enough: a unique mediocre password protects you better than an excellent reused one.

The most common attack today is not brute force, it is credential stuffing: someone takes an email and password from an old breach of some unrelated site and tries the same pair on your bank, your email and your social accounts. In that attack the complexity of your password is irrelevant — it is already known. What matters is that it does not open a second door.

Hence the real order of priority:

1. A different password on every service — protects against the most common attack.
2. Two-factor authentication — protects even when the password leaks.
3. A password manager — what makes the first two feasible at all.
4. Length — only then, and well before any concern about symbols.

Not every account deserves the same care

Protecting 80 accounts with equal rigour is unworkable, and unnecessary. There is a clear hierarchy:

• Your primary email is the master key. Whoever controls it can reset almost everything else — bank, social, shopping. That account deserves the longest password and mandatory 2FA, no exceptions.
• Then your bank, your password manager and your phone account (Apple or Google), which hold payment methods and location.
• Everything else last. The forum you signed into once in 2019 can have a random password you will never see — as long as it is unique.

Three old rules that have been abandoned

• Changing passwords every 90 days. NIST withdrew that recommendation: forced rotation produces predictable patterns (Password1, Password2, Password3) and makes security worse. Change when there is reason to suspect a leak.
• Substituting letters for symbols. Swapping "a" for "@" and "e" for "3" is the very first thing any cracking tool tries. "P@ssw0rd" is not stronger than "password" — it is the same word with a public rule applied.
• Requiring a symbol, a capital and a number. Composition rules push everybody towards the same predictable shape: capital first, number at the end, symbol just before it. Length buys more security with less friction.

Frequently asked questions

How do I pick genuinely random words? That is the hard part: words your brain chooses are not random, and the entropy in the table above only holds for a real draw. Use your password manager's generator, or the dice method (diceware), which draws from a list of 7,776 words.

Is it safe to keep everything in a password manager? Yes, and far safer than the real alternative — which is not "memorising 80 strong passwords" but reusing three passwords everywhere. Protect the manager with a long master password and 2FA.

Is writing a password on paper wrong? It depends on the threat. For most people the attacker is on the other side of the world, not inside the house — a slip of paper in a drawer beats reused passwords by a wide margin. Just do not tape it to the monitor.

How do I know if my password has leaked? Breach-checking services look up your email against public databases of exposed credentials. If it appears, change that service's password and every other place you reused it — which is precisely the problem.