Password advice has changed significantly over the past decade. Forced complexity rules — "use a capital letter, a number, and a symbol" — have given way to a clearer understanding of what actually makes passwords resistant to cracking. Here's what the research says in 2026.
The Old Advice Was Wrong
For years, the standard advice was: use uppercase, lowercase, numbers, and symbols. Change your password every 90 days. This came from NIST guidelines written in 2003 — before modern password cracking was well understood.
The result? Passwords like P@ssw0rd1 — technically complex but trivially guessable because humans create predictable patterns. The 2017 NIST update reversed course: length matters far more than complexity.
What Actually Makes a Password Strong
Length Is the Biggest Factor
Each additional character multiplies the number of possible combinations an attacker must try. A 16-character password of random lowercase letters is stronger than an 8-character password mixing all character types.
Randomness Matters More Than Character Sets
The key is unpredictability. correct-horse-battery-staple (a random four-word phrase) is stronger and far more memorable than Tr0ub4dor&3. Passphrases work because length compensates for using only words.
Uniqueness per Account
A strong password reused across multiple sites becomes worthless when one site is breached. Every account needs its own password — which is only practical with a password manager.
How Long Should Your Password Be?
| Password length | Time to crack (GPU attack) |
|---|---|
| 8 characters (all types) | Hours to days |
| 12 characters (all types) | Centuries |
| 16 characters (all types) | Practically infinite |
| 4 random words (passphrase) | Millions of years |
These estimates assume an attacker with a fast GPU performing brute-force attacks. Real attackers often use credential databases and pattern attacks first — making uniqueness equally important.
The Role of Two-Factor Authentication
Even the strongest password can be phished. 2FA (Two-Factor Authentication) means an attacker needs both your password and physical access to your second factor (phone, hardware key). Enable it everywhere it's offered — especially for email, banking, and cloud storage.
Password Managers: The Practical Solution
The only realistic way to have long, unique passwords for every account is to use a password manager. It generates and stores passwords for you — you only need to remember one master password.
Need a strong password right now? Use our password generator — it creates cryptographically random passwords directly in your browser, with no data sent to any server.
Conclusion
In 2026, the answer is: at least 16 characters, randomly generated, unique per account, with 2FA enabled wherever possible. Complexity rules are secondary to length and uniqueness. Use a password manager and a password generator — don't try to invent passwords yourself.