How to create a strong password
Length matters more than symbols. The NIST guidelines (SP 800-63B-4) require at least 15 characters for a password used on its own, and at least 8 when it comes with a second factor such as a code or a security key.
Updated November 6, 2026 · Sources
What NIST recommends
These rules are written for services that check passwords. They also tell you what really protects you:
- at least 15 characters for a password used on its own, at least 8 with a second factor;
- accept passwords of at least 64 characters, spaces included;
- no rules forcing a mix of character types (one capital, one digit, one symbol…);
- no forced periodic changes, but a forced change when there is evidence of compromise;
- reject passwords that are common, expected or already leaked;
- no password hints and no security questions;
- allow password managers, autofill and paste.
Why length wins
For a randomly drawn password, strength is measured in bits: length × log₂(number of possible characters). With the 94 printable keyboard characters, each character adds about 6.6 bits.
The result: 15 random lowercase letters give 71 bits, more than 8 characters of every type (52 bits). Adding characters pays off more than making each one complicated.
These figures only hold for random passwords. A made-up one (a name, a date, a common word) is far easier to guess than its length suggests.
| Length | Lowercase (26) | Lowercase and digits | All (94) |
|---|---|---|---|
| 8 | 38 | 41 | 52 |
| 12 | 56 | 62 | 79 |
| 15 | 71 | 78 | 98 |
| 20 | 94 | 103 | 131 |
Good habits
- A different password for every service: one leak must not open all your accounts.
- A password manager remembers long random passwords for you.
- For the ones you have to type, several randomly chosen words make a long phrase that is easy to remember.
- Turn on two-factor authentication when the service offers it.
- Change a password as soon as it may have leaked, not on a schedule.
Our generator
Our generator draws the characters in your browser with the system's cryptographic random generator. The password is never sent, saved or put in the page address.