How to Create a Strong Password (2026 Guide)

To create a strong password, make it long, unique and unpredictable. A password of 15 or more characters, built from several random words or generated by a password manager, beats a short one full of symbols. Use a different password for every account, never reuse one, and add two-factor authentication wherever you can. Here is exactly how to do it.

Key Takeaways

Length matters more than complexity, so aim for at least 15 characters.
A passphrase of several random, unrelated words is strong and easy to remember.
Use a different password for every account, because reuse lets one breach unlock many accounts.
A password manager creates and stores strong passwords so you do not have to remember them.
You no longer need to change passwords on a schedule, only when you suspect a breach.

What Is a Strong Password?

A strong password is one that is hard for people and software to guess, even with powerful tools. It is long, random and used for only one account. A weak password is short, predictable, based on personal details or reused across sites.

Attackers do not sit and guess by hand. They use programs that try billions of combinations and lists of passwords leaked in past breaches, so a password that looks complicated but follows a common pattern can still be cracked quickly.

What Do the Official Guidelines Say?

The US National Institute of Standards and Technology (NIST) now favours length over complicated rules. Its latest guidance says that a password used alone should be at least 15 characters long, and that systems should allow passwords of at least 64 characters. It also says organisations should not force people to change passwords regularly, only when there is evidence a password has been compromised, as set out in NIST’s digital identity guidelines.

NIST also tells services to check new passwords against lists of common and breached passwords, and to let people use password managers and paste passwords. These rules exist because forced symbols and monthly changes made people choose predictable passwords like a word with a number added at the end.

How to Create a Strong Password: Step-by-Step

Step 1 — Make it at least 15 characters long

Every extra character makes a password exponentially harder to crack. Treat 15 characters as a minimum for any account where the password is the only protection, and go longer for your email and banking accounts.

Step 2 — Use a passphrase of random words

A passphrase strings together several unrelated words, such as four or five picked at random, with separators if you like. It is long, easy to type and easier to remember than a jumble of symbols. Pick the words randomly, not from a song, quote or personal detail, and never use a famous example phrase you have seen online.

Step 3 — Avoid predictable patterns

Do not use your name, birthday, phone number, pet’s name or common words with simple swaps like an at sign for the letter a. Avoid keyboard patterns such as qwerty and obvious endings like 123 or the current year. Check your own passwords against a breach-checking service to see whether they have already leaked.

Step 4 — Use a different password for every account

When one site is breached, attackers try the same email and password on other services. Unique passwords stop one leak from spreading. Pay special attention to your email, since it can reset almost every other account.

Step 5 — Let a password manager do the work

You cannot remember dozens of long, random passwords, and you should not try. A password manager generates strong passwords, fills them in for you and stores them in an encrypted vault protected by one strong master passphrase. Read our guide to the top password managers to pick one.

Step 6 — Add two-factor authentication

Even a strong password can be stolen through phishing. A second step, such as a code from an authenticator app or a security key, protects your account if the password leaks. Our guide explains what two-factor authentication is and how to turn it on.

Step 7 — Switch to passkeys when you can

Passkeys replace passwords with a secure sign-in using your device, and they cannot be phished. Many major services now support them. See our guide to what a passkey is.

Is It Safe to Write Down or Store Passwords?

A password manager is the safest option, because it encrypts your passwords and fills them in automatically. Storing passwords in a plain notes app, a spreadsheet or a browser without a master lock is riskier. If you must write something down, keep it in a secure place at home and never write the master passphrase next to the device.

How Often Should You Change Your Passwords?

Change a password only when you have a reason, such as a data breach notification, a suspected hack, or having shared it with someone. Regular forced changes tend to make people choose weaker, predictable passwords. If a service tells you it has been breached, change that password immediately and anywhere else you used it.

What Should You Do If Your Password Is Stolen?

Change the password on that account right away, and on any other site where you used it.
Turn on two-factor authentication.
Check your account for unfamiliar activity, such as forwarding rules, logins or purchases.
Scan your device for malware, and follow our guide to removing malware from your PC if you find anything.

Frequently Asked Questions

What makes a strong password?

A strong password is long, unique and unpredictable. Aim for at least 15 characters, ideally a random passphrase or a password made by a password manager, and never reuse it on another account.

How long should a password be?

NIST recommends at least 15 characters for a password used on its own, and says systems should accept 64 characters or more. Longer is better, especially for email and banking.

Are special characters necessary?

Not required. Length and randomness matter more than symbols, and forced symbol rules often lead to predictable passwords. Special characters can help, but a long random passphrase is stronger than a short complicated one.

Should I change my passwords every 90 days?

No. Current NIST guidance says not to require regular changes. Change a password when you suspect it has been exposed or when a service reports a breach.

Is a password manager safe?

Reputable password managers encrypt your vault, and they are generally much safer than reusing passwords or storing them in a notes file. Protect yours with a strong master passphrase and two-factor authentication.

What is the best way to remember a strong password?

Remember only one strong master passphrase for your password manager, and let the manager remember the rest. For passwords you must memorise, use a passphrase of several random words.

Conclusion

Creating a strong password is simple once you know the rules: make it long, make it random, make it unique and protect it. Use a password manager to generate and store your passwords, add two-factor authentication to important accounts, and change a password only when you have a reason. A few minutes of setup now can save you from a serious account takeover later.