How to Create a Strong Password (What NIST Actually Says)

A strong password comes down to one number: how many guesses an attacker needs. Everything else, the symbols, the capital letters, the clever substitutions, matters only if it raises that number. Most of the time it does not.

Length beats complexity: the math

Password strength is measured in entropy, expressed in bits. Each bit doubles the number of guesses required. The formula is simple: entropy per character equals log2 of the character set size, multiplied by the length.

Here is what each character type contributes when chosen at random:

Character set	Size	Bits per character
Lowercase letters	26	~4.7
Lowercase + digits	36	~5.2
Mixed case + digits	62	~5.95
All printable ASCII	94	~6.55

Now compare two passwords. An 8 character password using all 94 printable characters gives about 52 bits. A 16 character password using only lowercase letters gives about 75 bits. The plain lowercase password is about 7 million times harder to brute force, despite having zero symbols.

The lesson: adding two characters helps more than adding a symbol requirement. Length scales exponentially. Complexity scales linearly, and only when the characters are actually random.

Why P@ssw0rd1! fails

P@ssw0rd1! looks like it satisfies every rule. Uppercase, lowercase, digit, symbol, ten characters. Cracking tools destroy it in seconds.

The reason is that attackers do not brute force blindly. Tools like Hashcat run dictionary attacks with mangling rules: take a wordlist, then apply the substitutions humans love. Swap a for @, o for 0, s for $. Capitalize the first letter. Append a digit and an exclamation mark. Every one of those transformations is a known rule, and cracking rigs apply millions of rule combinations per second.

P@ssw0rd1! is not a random 10 character string. It is the dictionary word “password” plus four predictable mutations. Its effective entropy is a fraction of what the character math suggests. The same applies to Summer2026!, Dragon#99, and every keyboard walk like Qwerty123!.

Randomness is the whole game. A password only gets full credit for its character set if a machine picked every character. If you want that, use a password generator rather than your own brain.

The passphrase method

Random strings are strong but painful to memorize. For passwords you must type from memory, use a passphrase: several words chosen at random from a large list.

The diceware approach uses a list of 7,776 words. Each randomly chosen word adds about 12.9 bits of entropy. Four words gives roughly 51 bits, five words about 64 bits, six words about 77 bits. A phrase like “cactus mural oven drift plank” is easy to remember and brutal to guess, because the attacker must search the full word list combination space.

The catch: the words must be random. A favorite quote, a song lyric, or words you picked yourself are all in attacker wordlists. Use a passphrase generator or physical dice, then keep whatever it gives you. For where each format wins, see passphrase vs password.

One password per site, and a manager

A strong password reused everywhere is a weak password. When one site gets breached and its password database leaks, attackers replay those credentials against every major service. This is credential stuffing, and it works because reuse is common.

The fix is unique passwords per site, which is only practical with a password manager. Let the manager generate long random passwords for every account. You memorize exactly one strong passphrase: the master password. Six random diceware words is a good target for that one.

If you want to test how a candidate password holds up, run it through a password strength checker that estimates guessability rather than just counting character types.

What NIST 800-63B changed and why

NIST SP 800-63B, the US government’s digital identity guideline, reversed years of conventional password policy. The key positions:

• No forced composition rules. Do not require symbols, digits, or mixed case. These rules push users toward predictable patterns (capital first, digit last) and add little real entropy.
• No forced periodic resets. Do not expire passwords on a schedule. Forced rotation produces Password1, Password2, Password3. Require a change only after evidence of compromise.
• Check against breach lists. Screen new passwords against lists of known compromised passwords and common choices, and reject matches. This blocks the passwords attackers actually try first.
• Support length. Since revision 4, require at least 15 characters wherever the password is the only authentication factor. Eight is permitted only when the password is one factor inside multi-factor authentication. Permit at least 64 characters so real passphrases fit.
• Allow paste. Blocking paste breaks password managers, and password managers are one of the best tools users have.

The reasoning behind every change is the same: policies should reflect how attacks actually work and how humans actually behave. Composition rules and forced resets looked rigorous on paper but produced weaker passwords in practice. Several of the habits they left behind are still repeated as advice; the password myths worth unlearning goes through the common ones.

The short version

Make it long. Make it random. Make it unique per site. Use a manager for everything, and one memorized passphrase for the manager itself. Ignore any advice that treats a symbol as a substitute for length.