Knowledge · Text, data and security
What makes a password strong?
Short answer
A strong password is long, randomly generated and used for only one account. Length and randomness matter more than mixing symbols: NIST SP 800-63B now recommends at least 15 characters when a password is the only factor, no forced composition rules, no scheduled expiry, and checks against lists of breached passwords. Four random words from a 7,776-word list give about 51.7 bits of entropy; six give about 77.5 bits.
Open Password generatorStrength is measured in guesses
Attackers do not guess letter by letter. They try leaked passwords first, then dictionary words with common substitutions, then patterns such as a capitalized word followed by a year and !. A password like P@ssw0rd2024! satisfies most complexity rules and still falls early, because every part of it is predictable.
Entropy measures how many guesses a password needs when it was generated at random. For a password of length L picked uniformly from a set of N symbols, entropy is L × log2(N) bits, and each extra bit doubles the work. The formula only applies to random generation; it says nothing useful about a password a person made up.
Entropy of common password styles
| Style | Symbol set | Bits per symbol | Example length | Total entropy |
|---|---|---|---|---|
| Lowercase letters | 26 | 4.70 | 16 characters | ≈ 75.2 bits |
| Letters and digits | 62 | 5.95 | 12 characters | ≈ 71.5 bits |
| All printable ASCII | 94 | 6.55 | 12 characters | ≈ 78.7 bits |
| All printable ASCII | 94 | 6.55 | 16 characters | ≈ 104.9 bits |
| Diceware words | 7,776 | 12.92 | 4 words | ≈ 51.7 bits |
| Diceware words | 7,776 | 12.92 | 6 words | ≈ 77.5 bits |
Worked example: log2(7,776) = 12.925, so four random words give 4 × 12.925 ≈ 51.7 bits, about 3.7 × 10^15 possibilities. An attacker running 10 billion guesses per second against a leaked fast hash would cover them all in roughly 4 days. Six words take about 700,000 years at the same rate.
Online attacks are far slower, since login forms rate-limit and lock out. The large margins matter for offline attacks after a database leak, where the guess rate depends on how the site stored the hash.
What NIST SP 800-63B now says
NIST Special Publication 800-63B, revision 4, finalized in 2025, sets password rules for US federal systems and is widely copied elsewhere. Its main requirements for services that accept passwords:
- Minimum length of 15 characters when the password is the only authenticator, and 8 when it is part of multi-factor authentication.
- Allow passwords of at least 64 characters, and accept spaces, all printable ASCII and Unicode characters.
- No composition rules such as requiring a digit, an uppercase letter and a symbol.
- No forced periodic changes. Require a change only when there is evidence of compromise.
- Check new passwords against a blocklist of breached, common or context-specific values such as the service name or username.
- No password hints or security questions, and allow paste so password managers work.
The reasoning is that composition rules and expiry push people toward predictable patterns like Summer2025! becoming Autumn2025!, which add little real entropy.
Passphrases vs random characters
| Random characters | Random words | |
|---|---|---|
| Example | r7#Qm2!vLx9@pT4z | orbit-candle-mosaic-thrift-velvet-harbor |
| Entropy | ≈ 105 bits (16 of 94) | ≈ 77.5 bits (6 of 7,776) |
| Easy to type | No, especially on phones | Yes |
| Easy to remember | No | With practice |
| Best for | Accounts stored in a password manager | The few passwords you must memorize |
Words must be picked at random, with dice or a generator, not chosen by you. A phrase from a song, a quote or a sentence you would write has far less entropy than its length suggests.
Practical rules
- Use a password manager and let it generate a unique random password, 16 characters or more, for every account. CISA gives the same advice.
- Memorize only a few passphrases: the password manager's master password and your device login. Use five or six random words.
- Never reuse a password. Credential stuffing, trying leaked email and password pairs on other sites, is one of the most common account takeovers.
- Turn on multi-factor authentication, preferably passkeys or an authenticator app rather than SMS, for email, banking and the password manager.
- Change a password when a service reports a breach, not on a calendar schedule.
FAQ
How long should a password be?
At least 15 characters for an account protected only by a password, per NIST SP 800-63B rev 4. For randomly generated passwords stored in a manager, 16 to 20 characters is a comfortable default.
Are passphrases more secure than passwords?
They can be, if the words are chosen at random. Six random words beat a typical 10-character human-made password, but a 16-character random password has more entropy than six words.
Should I change my passwords regularly?
No. NIST advises against forced periodic changes because they lead to predictable variations. Change a password when there is a sign of compromise, such as a breach notice.
Do special characters make a password stronger?
Only slightly. Going from 62 to 94 possible characters adds about 0.6 bits per character, while adding one more character adds about 6.5 bits. Length helps more than symbols.