A strong password is your first line of defence against unauthorised access. In this guide, we cover everything you need to know — from the science of entropy to practical creation techniques approved by NIST, NCSC, and OWASP.

What makes a password strong?

A strong password has three key properties: length, randomness, and uniqueness. NIST SP 800-63B recommends a minimum of 8 characters but security professionals recommend 16+ for sensitive accounts.

Password entropy explained

Entropy (measured in bits) quantifies how unpredictable a password is. Use the formula: E = L × log₂(P) where L is length and P is the character pool size. A 16-character password using all character types achieves ~105 bits of entropy.

Common Password Mistakes That Put You at Risk

Even people who consider themselves security-conscious make predictable errors when creating passwords. The most damaging mistake is reusing the same password across multiple accounts. When one service suffers a data breach—and breaches happen constantly—attackers take those leaked credentials and try them everywhere else in an automated attack called credential stuffing. A single reused password can unlock your email, banking, and social media in minutes.

Another frequent error is relying on personal information. Birthdays, pet names, street addresses, and your favorite sports team are all easily discovered through your social media profiles or public records. Attackers routinely build custom wordlists from a target’s online footprint before launching an attack. Similarly, predictable substitutions like swapping “a” for “@” or “o” for “0” in a dictionary word (P@ssw0rd) fool no one—cracking tools account for these patterns automatically.

What to Avoid Completely

• Keyboard patterns like “qwerty,” “asdfgh,” or “123456” appear at the top of every breached-password list.
• Single dictionary words, even long ones, fall quickly to dictionary attacks regardless of length.
• Sequential or repeated characters such as “aaaa1111” or “abcd1234” add almost no real entropy.
• Old passwords with a number tacked on—changing “Summer2025” to “Summer2026” is the first thing an attacker tries.
• Sharing passwords over email, text, or chat, where they sit in plaintext and can be intercepted or exposed later.
• Writing passwords on sticky notes near your workstation, a surprisingly common physical security failure in offices.

The NIST 2025 Guidelines: What Changed

The National Institute of Standards and Technology (NIST) overhauled its password recommendations, and the latest 2025 guidance in Special Publication 800-63B overturns decades of conventional advice. Understanding these changes helps you build passwords that align with modern security science rather than outdated rules.

• Length beats complexity. NIST now prioritizes longer passwords over forced complexity rules. A long passphrase is stronger and more memorable than a short string of mixed symbols.
• No more mandatory periodic resets. Forcing users to change passwords every 90 days actually weakens security, because people resort to predictable variations. NIST recommends changing passwords only when there is evidence of compromise.
• Drop the arbitrary composition rules. Requirements forcing at least one uppercase letter, one number, and one symbol are no longer recommended—they push users toward predictable patterns.
• Screen against breached password lists. NIST advises checking new passwords against databases of known-compromised credentials and rejecting any that appear.
• Allow all characters and long lengths. Services should permit passwords up to at least 64 characters and accept spaces and Unicode, enabling rich passphrases.

Practical Tips for Stronger Passwords

If you need to memorize a password, build a passphrase from four or more random, unrelated words—something like “copper-lantern-violin-harvest.” This approach delivers high entropy while remaining easy to recall, and it sidesteps the dictionary-word weakness because the combination is unpredictable. Add a number or symbol if a particular site demands it, but the real strength comes from the length and randomness of the word selection.

Treat your email password as the crown jewel. Because password resets for nearly every other account flow through your inbox, your email account deserves your longest, most unique password paired with two-factor authentication. Enable 2FA everywhere it is offered, ideally using an authenticator app or hardware key rather than SMS, which is vulnerable to SIM-swapping attacks.

How Password Managers Solve the Problem

The uncomfortable truth is that no human can memorize dozens of long, unique, random passwords. This is exactly the problem password managers were built to solve. A password manager generates genuinely random passwords—often 20 or more characters of pure entropy—stores them in an encrypted vault, and fills them in automatically when you visit a site. You only need to remember one strong master password to unlock everything else.

Beyond generation and storage, modern password managers actively defend you. They warn you about reused or weak passwords, alert you when a saved credential appears in a known data breach, and refuse to autofill on phishing sites because the domain doesn’t match. By offloading the impossible task of memorization to encrypted software, you can finally follow every best practice in this guide without friction—unique, maximum-strength passwords on every account, with no mental effort required.

The easiest way to ensure all your passwords meet these standards is to use a password manager like NordPass, which can generate and store cryptographically strong passwords for every account automatically.

{"type":"result","subtype":"success","is_error":true,"api_error_status":401,"duration_ms":806,"duration_api_ms":0,"num_turns":1,"result":"Invalid API key · Fix external API key","stop_reason":"stop_sequence","session_id":"b4f1b7b2-f399-471e-b98d-a4cbe37a73ec","total_cost_usd":0,"usage":{"input_tokens":0,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":0,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":0,"ephemeral_5m_input_tokens":0},"inference_geo":"","iterations":[],"speed":"standard"},"modelUsage":{},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"d47b65e4-34cb-4af5-86af-3d9b86fd9e82"}