How to create a strong password: what NIST and CISA actually recommend

For years, websites made you mix uppercase, numbers and symbols and change your password every 90 days. The result was passwords like Summer2026!, changed to Autumn2026! three months later. Easy to guess, hard to remember.

The US National Institute of Standards and Technology, whose guidance sets the baseline for federal systems and is widely copied, now says the opposite. In NIST SP 800-63B (revision 4, section 3.1.1.2), services:

• must require at least 15 characters when a password is the only thing you sign in with, and at least 8 when it is one of two factors;
• should allow at least 64 characters, and accept spaces and all printable characters;
• must not impose composition rules such as requiring a mix of character types;
• must not require periodic password changes, but must force a change if there is evidence of compromise;
• must check new passwords against a list of common, expected or compromised passwords;
• must allow password managers and autofill, and should allow pasting.

Those rules are aimed at the people who build sign-in systems, but they tell you what a strong password is: long, not on any list of known passwords, and not a pattern.

Attackers do not guess passwords one at a time by hand. After a breach they run software that tries billions of guesses, starting with leaked passwords, dictionary words and the predictable tricks people use: a capital at the start, a number and an exclamation mark at the end, @ for a. Each extra character multiplies the number of possibilities; swapping a letter for a symbol barely changes it, because the cracking tools already try that swap.

The Cybersecurity and Infrastructure Security Agency puts it simply: at least 16 characters, random, and unique to each account. It suggests either a random mix of characters or a passphrase of four to seven unrelated words.

You only need to remember a handful of passwords: your password manager's master password, your computer login and perhaps your main email. For those, a passphrase works well.

1. Let chance pick the words. Use your password manager's passphrase generator, or roll dice against a published word list such as the EFF's diceware lists. Words you choose yourself tend to be related, and related words are easier to guess.
2. Use five or six words for a master password, separated by spaces or hyphens, for example the shape lantern-copper-wobble-orbit-pasta (do not use this one, it is now public).
3. Do not decorate it with a capital and a number unless a site insists. It adds little.
4. Practice it a few times a day for a week, and write it down once on paper kept at home while it sticks. Paper at home is not the threat; reuse and phishing are.

Most people have dozens of online accounts. Nobody can remember a unique 16-character password for each, so people reuse them, and reuse is how one breach turns into ten. A password manager generates a random password for every account, fills it in, and only offers it on the real site. That also protects you from many phishing pages.

The free managers built into Apple and Google devices are fine for many households; our password manager comparison covers when a separate one is worth it.

Even a perfect password can be phished or leaked from a company's servers. Two more steps cover that:

• Turn on two-factor authentication for email, banking and anything holding money. See our 2FA guide.
• Use passkeys where sites offer them; there is no password to steal. See passkeys explained.
• Check whether your passwords have already leaked with the free tools in how to check for leaked passwords, and change any that appear.

The five-minute self-check shows which of these you already have.