What Makes a Strong Password

Why length matters more than complexity

The strength of a password against guessing attacks is usually described in terms of entropy, measured in bits. Entropy depends on two things: how many possible characters could appear in each position (the character set) and how many positions there are (the length). Every additional character multiplies the number of possible passwords, so length compounds strength faster than almost anything else you can do.

Complexity rules, by contrast, often add far less than people expect. Forcing one uppercase letter, one digit, and one symbol does increase the theoretical character set, but humans satisfy those rules in predictable ways: capitalizing the first letter, putting a number at the end, swapping 'a' for '@'. Attackers know these patterns and bake them into their cracking tools, so a short 'complex' password like P@ssw0rd1 is weak despite ticking every box.

Crucially, this entropy math only holds when the password is actually random. A long password built from a common phrase, a quote, or your dog's name plus a birthday has far less real entropy than its length suggests, because attackers guess words and patterns, not blind character combinations. Length is powerful specifically when the characters or words are chosen unpredictably.

Passphrases: long, memorable, and strong

A passphrase is a password made of several random words, such as four to six words chosen at random from a large list. This 'diceware' style approach (which selects words using dice rolls or another random method) produces credentials that are both long and genuinely random, which is the combination that matters. A six-word passphrase can exceed 75 bits of entropy while still being something a human can read and type.

The key word is random. 'correct horse battery staple' is strong because the words were selected unpredictably from a large dictionary; 'I love my dog so much' is weak because it is a common, guessable phrase. Use a method that picks words by chance rather than composing a sentence yourself.

NIST SP 800-63B explicitly supports this style of secret. It states that verifiers SHOULD permit memorized secrets at least 64 characters in length, and that all printing ASCII characters and the space character SHOULD be acceptable, with Unicode accepted as well. That means systems are expected to allow long passphrases with spaces rather than capping you at a short, awkward limit.

What the current NIST guidance actually says

NIST Special Publication 800-63B sets the U.S. federal baseline for digital identity and password (memorized secret) handling, and its modern recommendations overturn several long-standing habits that quietly made security worse.

Forced periodic resets are discouraged: the guideline says verifiers SHOULD NOT require memorized secrets to be changed arbitrarily, for example on a fixed schedule. Mandatory monthly or quarterly changes tend to push people toward minor, predictable variations (Spring2024, Summer2024), which helps attackers more than it helps you. Passwords should be changed when there is evidence of compromise, not on a calendar.

NIST also advises against imposing composition rules such as requiring mixtures of character types, and instead emphasizes length and screening. When a password is set or changed, verifiers SHALL compare it against a list of values known to be commonly used, expected, or compromised, including passwords from previous breach corpuses. In short: allow long passphrases, stop forcing arbitrary resets and arbitrary symbol rules, and block passwords already known to be exposed.

Password length vs approximate strength

The table below gives illustrative, approximate entropy figures so you can compare strategies. Values assume each character or word is chosen randomly and independently; real-world reused or pattern-based passwords are much weaker than these numbers imply. Entropy is computed as length multiplied by log2 of the set size: about 4.7 bits per random lowercase letter, about 6.6 bits per random character from the ~94 printable ASCII symbols, and about 12.9 bits per word from a ~7,776-word passphrase list. As a rough guide, under roughly 50 bits is weak, the 70s are reasonable, and 100+ bits is strong for most threats.

Treat these as order-of-magnitude comparisons, not guarantees. The headline takeaways: a 16-character random password and a five-to-six word random passphrase both land in genuinely strong territory, while short passwords stay weak no matter how many symbol rules they satisfy.

What to avoid, and the practical setup

Avoid the predictable. Do not reuse the same password across sites, because one breach then unlocks many accounts (credential stuffing). Avoid dictionary words on their own, names, birthdays, sports teams, keyboard walks like qwerty or 12345, and the leetspeak substitutions attackers already expect. Never use a password that has appeared in a known breach, even if it looks complex.

The realistic way to follow every recommendation at once is a password manager. It generates a long, fully random, unique password for each account and stores it encrypted behind one strong master passphrase, so you only have to remember one secret. This eliminates reuse, removes the temptation to pick something memorable-but-guessable, and lets you use the full length sites allow. Pair it with multi-factor authentication wherever offered, so a stolen password alone is not enough.

If you want to generate strong credentials right now, the password generator on this site produces long random passwords you can tune for length and character set. The UUID generator creates random, collision-resistant identifiers useful for tokens and keys, and the hash generator lets you compute checksums to verify data integrity. Use the password generator for the accounts themselves, and let your password manager remember the results.

Frequently asked questions

Try the tools

• Password Generator →
• UUID Generator →
• Hash Generator →

Sources & references

• NIST SP 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management
• NIST Special Publication 800-63 Digital Identity Guidelines (overview)
• NIST Computer Security Resource Center (CSRC)