How to create a strong password: rules and recommendations

A strong password is the first line of defense for an account. Weak passwords can be cracked in seconds through brute-force attacks, database leaks, and social engineering. This guide explains what makes a password strong, which rules are outdated, and how to generate passwords that are genuinely difficult to guess. For additional context, see Password security in 2026.

Why passwords still matter

Despite the rise of 2FA and passkeys, passwords remain the foundation of authentication. Many services do not support passkeys, and recovery codes and SMS are tied to the password. A leaked password gives an attacker access to an account, even if two-factor authentication is enabled — account recovery often goes through email protected by the same password.

Typical attack vectors:

• Brute force — trying dictionary words and combinations
• Data breaches — passwords from compromised databases end up in public collections
• Phishing — the user enters their password on a fake website
• Social engineering — guessing based on dates of birth, names, and hobbies

Length matters more than complexity

The classic rule of “at least 8 characters, with letters, numbers, and special characters” is outdated. Modern recommendations (NIST, OWASP) emphasize length.

95 — the number of printable ASCII characters (letters, numbers, special characters). Real-world cracking is slower because of hashing, but the trend is clear: a long password is significantly stronger than a short “complex” one.

Recommended length

• At least 12 characters for regular accounts
• 16+ characters for critical accounts (email, banking, admin panels)
• 20+ characters for a password manager’s master password

Entropy and randomness

Entropy measures how unpredictable a password is. The formula is log2(N^L), where N is the alphabet size and L is the length. A password of 16 random characters (95 possibilities) provides about 105 bits of entropy — enough to resist brute-force attacks.

Human-created passwords are predictable: replacing o with 0, a with @, or adding ! at the end. Attackers account for these patterns. Random generation eliminates predictability.

Calculating entropy

A password of 8 characters using an alphabet of 95 gives 8×log2(95) ≈ 52 bits. To achieve 128 bits of security, you need about 20 random characters from an alphabet of 95.

What makes a password weaker

Dictionary words

Summer2024! is a typical “strong” password. A dictionary word, a year, and a special character at the end are a standard pattern. These passwords can be quickly guessed using combinations of dictionary words and suffixes.

Personal information

Dates of birth, names, pet names, and nicknames are all easy to find out. Do not use anything in your passwords that can be found on social media or guessed.

Repeated characters

aaaaaaaa or 12345678 — zero entropy. Repetition reduces the effective length.

Reuse

Using one password for every service is disastrous if it is leaked. A breach at just one website can give an attacker access to all of a user’s accounts.

Rules for creating a password

1. Length of 12+ characters — prioritize this over “complexity”
2. Random generation — do not make one up manually
3. Uniqueness — one password per service
4. No personal information — no names, dates, or places
5. No dictionary words — or use a very long passphrase made of random words

Passphrase vs. random password

A passphrase is a sequence of random words: correct-horse-battery-staple. It is easy to remember and provides sufficient entropy with 4–6 words from a 7776-word dictionary (Diceware). The downside is length: 4 words provide ~52 bits, while 6 words provide ~78 bits.

A random password is K9#mX2$pL7@qR4!. It provides maximum entropy at minimum length. It is not memorable, so you need a password manager.

Recommendation: for passwords you need to remember (a rare case), use a passphrase of 5–6 words. For everything else, use random passwords stored in a password manager.

Generating passwords

Online generator

Generate passwords in a trusted password manager or a local generator. Use random values and a separate password for each account.

Local generation

# OpenSSL — 24 символа, base64
openssl rand -base64 24

# /dev/urandom — 16 символов, буквы и цифры
head -c 16 /dev/urandom | base64 | tr -d '/+=' | cut -c1-16

In a password manager

1Password, Bitwarden, KeePass, and others have built-in generators. Use them — the password is saved immediately and does not have to be copied to the clipboard again.

Generating passwords in code (for developers)

# Python
import secrets
import string
alphabet = string.ascii_letters + string.digits + "!@#$%^&*"
password = ''.join(secrets.choice(alphabet) for _ in range(20))

// Node.js
const crypto = require('crypto');
const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%';
let password = '';
for (let i = 0; i < 20; i++) {
  password += chars[crypto.randomInt(chars.length)];
}

Use a cryptographically secure random number generator (secrets in Python, crypto.randomInt in Node), not Math.random().

Checking password strength

Services like “How Secure Is My Password” provide a rough guide, but do not reveal the details of their algorithms. It is better to focus on:

• Length (the most important factor)
• Randomness (no patterns)
• Uniqueness (check for data breaches)

Breach check: Have I Been Pwned — enter a password (or its hash) to find out whether it has appeared in known breaches. The service uses k-anonymity; the full password is not transmitted.

Storing passwords

A password manager is the only practical way to store dozens of unique passwords. The master password should be especially strong: a long passphrase or 20+ random characters.

A notebook is acceptable only for a master password, if it is kept physically in a secure place. It is not suitable for storing many passwords.

A browser is convenient, but synchronization and access depend on your Google/Apple account. A dedicated password manager is preferable for critical passwords.

A file on your computer is dangerous without encryption. If you use one, use only an encrypted container (VeraCrypt, encrypted disk image).

Password checklist

• At least 12 characters long (16+ for critical accounts)
• Generated randomly
• Unique for each service
• Contains no personal information or dictionary words
• Stored in a password manager
• The password manager’s master password is the strongest one
• 2FA is enabled wherever possible

Frequently asked questions

Are special characters necessary?

Special characters increase the alphabet size and entropy, but length matters more. A password with 20 letters and numbers is stronger than one with 10 characters and special characters. Many systems require special characters — use them, but do not sacrifice length.

How often should I change my password?

NIST and OWASP do not recommend mandatory periodic password changes without a reason. Changing a password every 90 days leads to weaker passwords (users add suffixes). Change your password if you suspect it has been compromised or after a service breach.

What should I do if there is a data breach?

Immediately change your password on the affected service. Check all accounts where you used the same password and change it everywhere. Enable 2FA if it is not already enabled. For critical services (email, banking), change your password as a precaution, even if the breach occurred on another website.

Is a browser-based generator safe?

A browser-based generator can be safe if the code runs locally and the password is not sent to a server. Check the service’s privacy policy. For maximum security, use a generator in a password manager or local utilities (openssl, pwgen).

Tools for checking

In addition to Have I Been Pwned, these tools are useful:

• Password managers — built-in breach checks (1Password Watchtower, Bitwarden)
• Chrome Password Checkup — checks passwords saved in the browser
• Firefox Monitor — HIBP integration for email monitoring

Recommendations for organizations

An organization’s password policy should include:

• A minimum length of 12 characters (NIST recommends 8, but 12 is safer)
• A ban on reusing corporate passwords for personal accounts
• Mandatory 2FA for access to critical systems
• Employee training on phishing and social engineering
• A team password manager with centralized management

Conclusion

A strong password combines length, randomness, and uniqueness. Outdated rules about “complexity” are giving way to an emphasis on length. Generate passwords randomly, store them in a password manager, and enable 2FA. One strong password per service and a master password for the manager are the foundation of personal cybersecurity.

Learn more about password managers, 2FA, and passkeys in Password security in 2026.