How do I create a strong password?
download.fan · Updated
Short answer
Make it long, random and different for every account. CISA recommends at least 16 characters, either a random mix of characters or a phrase of 4 to 7 unrelated words. The easiest way is to let a password generator create it and a password manager store it, then protect that manager with a long passphrase and two-factor authentication.
Step by step
Step 1: Choose the length
Use at least 16 characters, or more if the site allows it.
Step 2: Generate it randomly
Use a password generator, since people pick predictable patterns.
Step 3: Use it once
Never reuse it, so that a breach of one site doesn't expose others.
Step 4: Store it safely
Save it in a password manager, which also fills it in for you.
Step 5: Turn on two-factor authentication
Add it to your email, bank and password manager first.
How long should a password be?
CISA says at least 16 characters. NIST's digital identity guidelines require services to enforce at least 15 characters when a password is the only sign-in factor, and say they should allow at least 64.
Each added random character multiplies the possibilities. At an assumed 100 billion guesses a second, a random 8-character password from 94 keyboard characters (about 52 bits) falls in under a day. At 16 characters (about 105 bits), trying every combination would take trillions of years.
Do I need symbols and numbers?
Length matters more. NIST now tells services not to impose composition rules, such as requiring a symbol, and not to force periodic password changes without evidence of compromise. Some sites still have those rules, so include a symbol when you must. Patterns like P@ssw0rd1! are widely known to attackers, so they add little.
How do I generate a strong password?
Use this password generator, a password creator that runs in your browser. It draws characters from the Web Crypto API's secure random number generator, and it says nothing is sent or stored. Set the length to 16 or more, and exclude ambiguous characters if you'll ever type it by hand.
What about a password I have to remember?
Use a passphrase of unrelated random words. EFF's dice method has you roll five dice to pick each word from a list, and suggests six words, which gives about 77 bits of randomness. It's strong, and much easier to type than a random string.