How to Create a Strong Password in 2026
Updated 27 September 2026 · 6 min read
A strong password is long, random and used on one account only. Clever tricks such as swapping letters for numbers add almost nothing. Here's what really makes a password hard to crack, how to manage dozens of them, and where 2-step verification and passkeys fit in.
Length beats complexity
The real danger isn't guessing on a login page, where attempts are limited. It's a data breach: a password database leaks and attackers test guesses offline, as fast as their hardware allows. Then what protects you is the number of possibilities, and every extra character multiplies it.
The table assumes, purely for illustration, an attacker testing 10 billion guesses a second. Real speeds depend hugely on how the site stored its passwords, but the comparison holds. Strength is shown in bits: each extra bit doubles the work.
| Password, chosen at random | Strength | Time to try every option |
|---|---|---|
| 8 lowercase letters | 38 bits | About 21 seconds |
| 12 characters from letters, digits and symbols (81 options each) | 76 bits | About 250,000 years |
| 5 words from a 7,776-word list | 65 bits | About 90 years |
| 6 words from the same list | 78 bits | About 700,000 years |
| 20 characters from 81 options | 127 bits | Far longer than the age of the universe |
The catch is the word random. "Summer2026" is ten characters, but cracking tools try patterns like it early, because people reach for seasons, names, years and keyboard runs like "qwerty". The numbers above only hold when every character or word is picked by chance.
What the current NIST guidance says
The US National Institute of Standards and Technology publishes password rules that many IT teams worldwide follow. Its SP 800-63B guidelines (Revision 4, finalised in 2025) say:
- Passwords used on their own should be at least 15 characters. When a password is one part of multi-factor sign-in, the minimum is 8.
- Sites should allow at least 64 characters, including spaces and Unicode.
- Sites should not impose composition rules such as "one uppercase letter, one number and one symbol".
- Sites should not make you change passwords on a schedule, only when there is evidence a password has been compromised.
- New passwords should be checked against a blocklist of common and breached passwords.
- Password managers and pasting should be allowed. Password hints and security questions should not be used.
Many sites still use older rules like "must contain a symbol". Follow them where you must, but rely on length. The guidance is revised periodically, so check the NIST page for the latest version.
Passphrases, and what to avoid
For the few passwords you must memorise (device login, main email, password manager), a passphrase of random words is far easier to remember than a jumble of symbols.
The UK's National Cyber Security Centre recommends three random words as a simple step up from typical passwords. For anything that protects other accounts, such as a password manager, go longer. The Electronic Frontier Foundation's dice method picks each word by rolling five dice against a list of 7,776 words, and suggests at least six words.
Random is what matters. A song lyric, a film quote or "ILoveDubai" is not random. Also avoid:
- Reusing passwords, including small variations like "Dubai2025" and "Dubai2026".
- Letter-for-number swaps like "P@ssw0rd". Cracking tools try these automatically.
- Personal details such as birthdays, phone numbers, car plates and family or pet names, which are often visible on social media.
- Sending passwords over WhatsApp or email, or keeping them in a spreadsheet called "passwords".
Let a password manager do the remembering
Reusing a password is how a leak at a small shopping site turns into someone reading your email: attackers try leaked email and password pairs on other sites, a technique called credential stuffing.
A password manager keeps every password in an encrypted vault behind one master password, fills them in and generates new ones. Options include the managers built into Google Chrome, Apple's Passwords app and Microsoft Edge, or dedicated apps such as Bitwarden and 1Password. A useful side effect: a manager only fills a password on the site it was saved for, so it won't offer your bank password on a lookalike phishing page.
- Choose a manager and protect it with a long passphrase and 2-step verification.
- Change your most important passwords first (email, banking, work, cloud storage), then the rest as you next sign in to each site.
- Check old passwords against breach data. Pwned Passwords does this without receiving your password: it is hashed on your device and only the first five characters of the hash are sent. Change any that turn up.
Add 2-step verification, or move to passkeys
With 2-step verification, a stolen password alone isn't enough: the site also asks for a code from an authenticator app, a phone prompt or a hardware security key. Text-message codes are better than nothing, but NIST classes them as "restricted" because phone numbers can be hijacked through SIM swaps. Use an app or a security key where you can.
Passkeys replace the password altogether. The FIDO Alliance, which maintains the standard, describes a passkey as a cryptographic key pair: the private key stays on your device or in your password manager, and you approve each sign-in with the fingerprint, face or PIN you already use on your phone. The site stores only the public key, so a breach leaks nothing reusable, and a passkey only works on the real site it was made for, which makes it resistant to phishing. Google, Microsoft and Apple accounts all support passkeys. Turn them on where offered, and keep recovery codes somewhere safe offline.
Generate a password with SAA Tool
Our Password Generator uses crypto.getRandomValues, the cryptographic random number generator built into your browser. Everything happens on your device; nothing is sent to our server. You can check: load the page, switch off Wi-Fi and keep generating.
- Set the length: 20 characters by default, anything from 4 to 128.
- Tick the character sets you want: uppercase, lowercase, numbers and symbols. With all four, each character is one of 81 options, so a 20-character password has about 127 bits of strength.
- Choose how many to create (up to 50), click Generate and copy one straight into your password manager. We store nothing, so the list is gone once you leave.
One limit to know: it makes random characters, not word passphrases, so use the dice method for anything you must memorise. Every password it makes includes at least one character from each type you tick, so it passes sites that insist on a number or a symbol. If a site rejects some symbols, untick Symbols and add a few characters of length instead.
Frequently asked questions
How long should my password be?
At least 15 characters for any account protected by a password alone, as NIST recommends. For passwords kept in a manager, 16 to 20 random characters is comfortable. For a passphrase you memorise, use five or six random words.
Is it safe to use an online password generator?
Yes, if it creates passwords in your browser with a cryptographic random generator and sends nothing anywhere, as ours does. Your password manager's built-in generator is equally good.
Should I still change my passwords every 90 days?
Current NIST guidance tells organisations not to force routine changes. Change a password when there's a reason, such as a breach, a phishing attempt or a lost device. If your employer's policy still requires expiry, follow it.
Will passkeys replace passwords completely?
Not yet. Many sites still need a password as a fallback, and some don't support passkeys at all. Use passkeys where you can and strong, unique passwords everywhere else.