Passwords · 9 min read

How to create a strong password (and why the old advice was wrong)

The capital letter, the number, the symbol on the end, the change every ninety days — the body that popularised that advice has formally walked most of it back. Here is what replaced it.

Most of what people believe about strong passwords is a decade out of date, and a fair amount of it was never right in the first place. The capital letter, the number, the exclamation mark on the end, the mandatory change every ninety days — that entire ritual has been formally walked back by the body that popularised it.

The US National Institute of Standards and Technology publishes the guidance most organisations copy, in a document called SP 800-63B. Its modern revisions say something close to the opposite of the advice you were given at work: stop forcing complexity, stop forcing routine changes, and make length the thing that matters.

Here is what that means in practice.

Length beats complexity, and it is not close

Every character you add multiplies the number of possibilities an attacker must work through. Every extra character class — uppercase, digits, symbols — merely widens the alphabet slightly. Length compounds; complexity does not.

Compare two passwords. P@ssw0rd! is nine characters and uses all four character classes, so it satisfies almost every corporate policy ever written. It is also in every cracking dictionary in existence, because the substitutions people make are entirely predictable: a becomes @, o becomes 0, s becomes 5, and an exclamation mark goes on the end.

correct horse battery staple is four ordinary words. No capitals, no digits, no symbols. It would fail that same corporate policy. It is also dramatically harder to attack, because it is twenty-eight characters long and the words are not related to each other.

Current guidance reflects this: a minimum of eight characters, with fifteen or more recommended where a password is doing the work alone. Longer is better, and passphrases are explicitly encouraged because they deliver length that a human can actually remember and type.

Stop changing passwords on a schedule

The ninety-day rotation policy is the clearest example of security advice that made things worse.

The intent was reasonable: if a password leaks, rotation limits how long it is useful. The behaviour it produced was not. When people are forced to change a password they must remember, they do not invent a fresh strong one twelve times a year. They increment. Summer2024! becomes Summer2025!. Password1 becomes Password2. Attackers know this, and guessing the next in a sequence is trivial once you have the last one.

Worse, forced rotation pushes people toward passwords weak enough to memorise under pressure, and toward writing them somewhere convenient and insecure.

Modern guidance is to change a password when there is evidence it has been compromised — a breach notification, a suspicious login, a shared credential when someone leaves — and otherwise to leave a strong, unique password alone.

Reuse is the actual problem

If you fix one thing, fix this. Password strength is almost irrelevant compared to password reuse.

The attack is called credential stuffing and it requires no skill. A site with poor security gets breached. Its email-and-password pairs are collected and traded. Software then tries those same pairs automatically against hundreds of other services — banks, email providers, shopping sites, social networks.

If you used the same password on the breached forum and on your email, the strength of that password is irrelevant. It was not cracked. It was known, and simply typed in somewhere else.

This is why guidance now emphasises blocklists — checking new passwords against known-breached ones — rather than character rules. Whether a password has already appeared in a breach tells you far more about its real-world safety than whether it contains a symbol.

What a strong password looks like now

Long. Aim for fifteen characters or more on anything that matters. Four or five unrelated words is easy to reach that way.

Unique to that service. Non-negotiable for email, banking and anything holding your identity documents. Your email password is the most important one you own, because it can reset everything else.

Not derived from anything about you. Names, birthdays, teams, pets, street names. All of it is either public or guessable by someone who knows you, which covers the majority of real account compromises between people who know each other.

Not a predictable pattern. Keyboard walks, a word plus the current year, or a base word with a rotating number are all handled by standard cracking rules.

Not reused. Ever. Worth saying twice.

How to actually make one you will remember

For the handful of passwords you must type from memory — your device unlock, your password manager's master password — use a passphrase built from genuinely random words.

The critical word is random. If you choose four words yourself, you will pick words that go together, because human minds work by association, and that association is exactly what makes it guessable. Pick them by some mechanism that is not your own taste: dice and a word list, a shuffled book, or a generator you trust. Then make a mental image of the absurd sentence they form, which is what makes it stick.

For everything else, do not remember anything. Let software generate long random strings and store them. You should not know your own Netflix password.

Two-factor matters more than password perfection

Perfecting a password gives diminishing returns quickly. Adding a second factor changes the shape of the problem entirely, because a stolen password on its own stops being enough.

Not all second factors are equal. An authenticator app or a hardware key is substantially better than an SMS code, because SIM swapping is a real and well-practised attack. Where a service offers both, take the app.

Turn it on for email first. Email is the master key to everything else, and it is the account most worth protecting.

Where to keep them

Once every password is long, unique and random, you cannot memorise them, which is the point. So the storage question is the real question, and there are three defensible answers.

A syncing password manager. The right default for most people. Autofill on a laptop, everything everywhere, and the vault is encrypted before it leaves your device. Bitwarden's free tier is genuinely good.

An offline vault. No account, nothing on anyone's server, and no login page to phish. The trade is that it lives on one device and you are responsible for the backup. This suits people whose logins are mostly phone logins.

Paper, at home. Unfashionable and entirely legitimate for a handful of high-value passwords. A notebook in a drawer is not vulnerable to credential stuffing. It is vulnerable to burglary and fire, which are risks you can reason about.

What is not defensible is the middle ground almost everyone lives in: a plain-text note on the phone, a spreadsheet called passwords.xlsx, or the same eight characters with a rising number on the end.

If you do only three things

Change your email password to a long unique passphrase, and turn on two-factor authentication with an app rather than SMS.

Stop reusing passwords on anything financial or identity-related — bank, government services, anywhere your documents are stored.

Put the rest in something that generates and remembers them, so you never have to think about this again.

That is most of the available benefit, and none of it involves memorising a string of symbols or changing anything every ninety days.