**

Strong Password Examples (With the Math Behind Each)

The fastest way to understand password strength is to look at real examples with the numbers attached. Below are passwords that hold up, passwords that collapse, and the math that separates them.

One rule before the tables: never use any example from this page. Published passwords end up in attacker wordlists, including these. The examples teach the pattern. Your actual password must come from a password generator, a passphrase generator, or physical dice.

How the entropy numbers work

Entropy measures the size of the search space an attacker must cover, in bits. Each bit doubles the work. For a random string, entropy equals length times log2 of the character set size. For a random passphrase, it equals words times log2 of the wordlist size (about 12.9 bits per word on the 7,776 word diceware list).

These numbers only apply when every character or word is chosen at random. A human-invented password gets no such credit.

Strong examples

# Example Type Approx. entropy Why it works
1 kV9#mQ2$xL7pW4tz 16 char random, full ASCII ~105 bits Machine-random, no structure for rules to exploit
2 xqvhbrntwdkmzjfp 16 char random lowercase ~75 bits Length alone carries it; easy to type on mobile
3 H7d2mK9qX4wP 12 char random alphanumeric ~71 bits Compact but fully random; fine for rate-limited logins
4 crayon-velvet-mango-drift 4 random diceware words ~52 bits Memorable; adequate where lockouts slow guessing
5 plank-orbit-satchel-nimbus-quartz 5 random diceware words ~64 bits Strong and still speakable over a phone
6 bramble-cider-lagoon-pylon-hexnut-fjord 6 random diceware words ~77 bits Master-password grade; resists offline cracking
7 Tq8v-Rm2x-Kp7d-Wn4z Grouped 16 char random ~95 bits Chunking helps manual entry; the hyphens are fixed separators and add nothing
8 gale7 mossy4 tundra1 raven8 Words + random digits ~63 bits Digits appended by the generator, not by habit
9 9fXk#2LmQ8vT$5wZ7pRj 20 char random, full ASCII ~131 bits Overkill in a good way; manager-filled, never typed
10 otter-jigsaw-comet-birch-viola 5 random diceware words ~64 bits Random words, no theme, no quote
11 mzqXw72TkfLp 12 char random mixed case + digits ~71 bits Small footprint, full randomness
12 walnut-fable-igloo-sprint-domino-relay 6 random diceware words ~77 bits Long, memorable, immune to dictionary rules

Notice what is absent: no names, no dates, no keyboard patterns, no leetspeak. Strength comes from randomness and length, nothing else. If you want a second opinion on a candidate, a password strength checker that estimates guesses (not one that counts character classes) will confirm these rankings.

Anti-examples: passwords that pass the rules and still fail

Each of these satisfies typical “must contain uppercase, digit, symbol” policies. Each falls quickly to standard cracking rules.

Anti-example Why it fails
P@ssw0rd2024 The word “password” plus the three most common substitutions plus a year. Every cracking rig tries this family first.
Summer2026! Season + year + exclamation is one of the most common human templates on earth.
Qwerty123! Keyboard walk plus sequential digits. Keyboard patterns are in every wordlist.
1qaz2wsx Looks random, is actually two vertical keyboard columns. A known pattern.
Dragon#99 Single dictionary word, symbol, repeated digit. Dictionary plus rules cracks it in seconds.
Priya@1995 Name plus birth year. Attackers targeting you will try personal data first.
Ilovemydog2! Common phrase structure. Phrase dictionaries include sentence-style passwords.
Admin@123 Among the most breached passwords in existence. Rejected by any breach-list check.
correcthorsebatterystaple The famous comic example. Great method, but this exact phrase is in every wordlist now.
M0nk3y!! Only 8 characters, and the substitutions are standard mangling rules. Short and predictable.

The common thread: every anti-example is a template. Word plus year. Word plus symbol. Pattern plus digits. Cracking tools do not guess character by character; they guess template by template, and human templates number in the millions, not the trillions.

How to pick the right strength for the job

  • Manager-filled logins: use 16 to 20 random characters (examples 1, 7, 9 style). You never type them, so length costs nothing.
  • Memorized passwords (master password, computer login, disk encryption): use 5 to 6 random diceware words (examples 5, 6, 12 style). These face offline attacks, so aim high.
  • Passwords you must say aloud or type on a TV: 4 to 5 short random words beat a symbol soup you will misread twice.

This matches NIST SP 800-63B, which favors length over composition rules, screening against breached password lists, and letting users paste from managers. If any of the older rules still sound right to you, the password myths worth unlearning explains what replaced them.

Generate, do not imitate

Copying the shape of a strong example by hand still produces a human pattern. The only way to get the entropy the table promises is to let a machine or dice make every choice. Generate one now with the password generator or the passphrase generator, store it in your manager, and move on.

Frequently asked questions

Can I use one of these example passwords for my account?
No. Any password published anywhere is effectively burned, because attackers scrape example lists into their wordlists. Use the examples to learn the patterns, then generate your own with a random generator or dice.
How much entropy does a password need?
For accounts protected by rate limiting, around 50 bits is reasonable. For anything that could face offline cracking, such as a password manager master password or disk encryption, aim for 75 bits or more, which is about six random diceware words.
Why is Summer2026! a weak password even though it has a capital, a number, and a symbol?
Because it follows a human pattern: a common word, the current year, and a trailing exclamation mark. Cracking tools apply exactly these mangling rules to wordlists, so it falls in seconds despite passing composition checks.