A strong password is your first line of defence against unauthorised access. In this guide, we cover everything you need to know — from the science of entropy to practical creation techniques approved by NIST, NCSC, and OWASP.

What makes a password strong?

A strong password has three key properties: length, randomness, and uniqueness. NIST SP 800-63B recommends a minimum of 8 characters but security professionals recommend 16+ for sensitive accounts.

Password entropy explained

Entropy (measured in bits) quantifies how unpredictable a password is. Use the formula: E = L × log₂(P) where L is length and P is the character pool size. A 16-character password using all character types achieves ~105 bits of entropy.

Using a password manager like NordPass is the easiest way to generate and store strong, unique passwords for every account without having to memorise them.

{"type":"result","subtype":"success","is_error":false,"api_error_status":null,"duration_ms":33144,"duration_api_ms":34051,"ttft_ms":2779,"ttft_stream_ms":2776,"time_to_request_ms":375,"num_turns":1,"result":"

The Mathematics of Cracking: How Long Would It Take?

\n

The single most useful way to understand password strength is to ask a simple question: how long would a modern attacker take to guess it? The answer depends on two things — the size of the \"search space\" (every possible combination of characters) and the speed at which an attacker can test guesses. A consumer-grade GPU rig in 2026 can attempt tens of billions of hashes per second against weak algorithms like unsalted MD5, while purpose-built cracking clusters push into the trillions. Cloud-rented hardware means even a casual attacker can rent that firepower by the hour.

\n

This is where character variety and length combine to create exponential growth. Each additional character multiplies the total number of possibilities, not merely adds to them. Consider how dramatically crack time scales with length when you use a full mix of uppercase, lowercase, numbers, and symbols (roughly 95 possible characters per position):

\n

\n
• 8 characters: cracked in hours to a few days — never acceptable in 2026.
\n
• 10 characters: several months to a few years, depending on hardware.
\n
• 12 characters: centuries under most realistic attack budgets.
\n
• 16 characters: effectively uncrackable with current and foreseeable technology — trillions of years.
\n

\n

The lesson is unambiguous: length is the most powerful lever you control. Adding four characters to a password does far more for your security than swapping a single letter for a symbol. This is why security professionals increasingly recommend a minimum of 14–16 characters for any account that matters.

\n\n

Passphrases: Long, Memorable, and Genuinely Strong

\n

If long passwords sound impossible to remember, the solution is the passphrase — a string of several unrelated words. A phrase like correct-battery-staple-harbor-velvet is 37 characters long, trivial to recall after a few uses, and would take an attacker astronomically longer to crack than a tortured eight-character string like P@ssw0rd. The key is randomness: choose words that have no logical or grammatical connection. Song lyrics, famous quotes, and common phrases are weak because attackers feed entire books, movie scripts, and leaked password lists into their cracking dictionaries.

\n

To build a strong passphrase, follow these principles:

\n

\n
• Use at least four or five random words chosen by a tool, not by your brain — humans are predictable.
\n
• Separate words with symbols or numbers to add entropy and defeat dictionary segmentation.
\n
• Avoid personal information: names, birthdays, pet names, and addresses are the first things attackers try.
\n
• Mix in deliberate capitalization at unexpected positions rather than only at the start.
\n

\n\n

The Mistakes That Undo Strong Passwords

\n

Even a mathematically strong password fails if you use it badly. The most damaging habit is reuse. When a single website suffers a breach — and billions of credentials are exposed every year — attackers immediately try those same email-and-password combinations on banking, email, and shopping sites. This technique, called credential stuffing, is automated and ruthlessly effective. One leaked password can cascade into a dozen compromised accounts within minutes.

\n

Other common errors include:

\n

\n
• Predictable substitutions: replacing \"a\" with \"@\" or \"o\" with \"0\" adds almost nothing, because every cracking tool already knows these tricks.
\n
• Keyboard patterns: sequences like qwerty, 1q2w3e, or asdfgh appear in every attacker's wordlist.
\n
• Appending numbers: ending a word with \"123\" or the current year is one of the first patterns tested.
\n
• Storing passwords in plain text: a note on your phone or a spreadsheet defeats the purpose entirely.
\n

\n\n

Tools and Habits That Make Strong Passwords Effortless

\n

The realistic way to maintain dozens of unique, long passwords is to stop trying to remember them all. A reputable password manager generates, stores, and autofills random credentials, leaving you with just one master passphrase to memorize. This eliminates reuse and lets every account have maximum-strength protection without mental effort.

\n

Pair your passwords with these defensive layers:

\n

\n
• Enable two-factor authentication (2FA) everywhere it is offered — ideally with an authenticator app or hardware key rather than SMS, which is vulnerable to SIM-swapping.
\n
• Check your exposure regularly using a breach-monitoring service to learn whether any of your credentials have leaked.
\n
• Prioritize your critical accounts — email, banking, and your password manager itself deserve the longest, most unique passphrases, since they unlock everything else.
\n
• Update compromised passwords immediately rather than waiting, and never recycle an old one.
\n

\n

Strong password creation in 2026 is no longer about clever tricks or impossible memorization. It is about understanding the simple math — length defeats time — and pairing that knowledge with the right tools. Generate long, random, unique credentials for every account, protect the important ones with 2FA, and you transform your passwords from a liability into a genuine, durable line of defence.

","stop_reason":"end_turn","session_id":"d9512b87-badf-4bf9-836a-99b7dcad3935","total_cost_usd":0.12398600000000001,"usage":{"input_tokens":8492,"cache_creation_input_tokens":2302,"cache_read_input_tokens":15362,"output_tokens":1998,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":2302,"ephemeral_5m_input_tokens":0},"inference_geo":"not_available","iterations":[{"input_tokens":8492,"output_tokens":1998,"cache_read_input_tokens":15362,"cache_creation_input_tokens":2302,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":2302},"type":"message"}],"speed":"standard"},"modelUsage":{"claude-haiku-4-5-20251001":{"inputTokens":775,"outputTokens":20,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.000875,"contextWindow":200000,"maxOutputTokens":32000},"claude-opus-4-8[1m]":{"inputTokens":8492,"outputTokens":1998,"cacheReadInputTokens":15362,"cacheCreationInputTokens":2302,"webSearchRequests":0,"costUSD":0.12311100000000001,"contextWindow":1000000,"maxOutputTokens":64000}},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"a08381a5-2672-4867-9a89-fea6e2767c5c"} {"type":"result","subtype":"success","is_error":true,"api_error_status":401,"duration_ms":640,"duration_api_ms":0,"num_turns":1,"result":"Invalid API key · Fix external API key","stop_reason":"stop_sequence","session_id":"46127b8f-b932-44b5-90be-37a9c6e1def1","total_cost_usd":0,"usage":{"input_tokens":0,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":0,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":0,"ephemeral_5m_input_tokens":0},"inference_geo":"","iterations":[],"speed":"standard"},"modelUsage":{},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"d19250a3-00ce-442e-b4d4-d9b454ccfa5a"}