How to Create a Strong Password in 2026 (Length Beats Complexity)
Still using Password1!? The latest security guidance flips the old rules — length matters more than symbols. Here's how to make a password that's genuinely hard to crack yet easy to remember, why you should stop forcing periodic changes, and the tools to use.
Half of what most people believe about "strong passwords" is wrong and out of date. Many think a strong password means something stuffed with uppercase, numbers and symbols — like P@ssw0rd!. But the latest security guidance has flipped: what matters isn't how complex it is, but how long. Here's how to do passwords right in 2026.
The shift: length over complexity
The old "mix uppercase, numbers and symbols" rule is now seen as counterproductive — it produces predictable passwords like Password1!.
The current advice (NIST, 2026) is simple: win on length. A 20-character, all-lowercase passphrase is harder to crack than an 8-character symbol-stuffed password — and far easier to remember.
Hard to remember, easy to guess: P@ssw0rd!2
Easy to remember, hard to crack: blue bicycle ate three stars
Computers crack passwords by brute force, where each extra character raises difficulty exponentially. So "long enough" beats "every character type."
Four principles of a good password
| Principle | Why |
|---|---|
| Long | At least 15 characters, especially without MFA |
| Unique per site | One breach doesn't cascade to other accounts |
| Unpredictable | No birthdays, phone numbers, names or keyboard runs |
| Use a passphrase | A few unrelated words: long and memorable |
How long?
- Password is your only factor → at least 15 characters
- With MFA → 8 minimum, but longer is better
- Ceiling can be 64+ — don't be shy
Two old habits to drop
1. Stop forcing periodic changes. Unless there's evidence of a breach, you don't need to change every three months — it just produces Pass1 → Pass2. Set a strong one and leave it; change immediately only if you suspect a breach.
2. Stop stuffing symbols. Rather than turning a into @ and o into 0 (attackers' dictionaries already cover that), just make it longer.
How to do it: three steps
- Generate a strong password. Use our password generator — set length to 16+ and generate a truly random one. It runs in your browser and isn't uploaded.
- Store it in a password manager, don't memorise. You can't remember unique long passwords for every site — let a manager handle it; see best password managers.
- Turn on MFA and passkeys. Enable two-factor authentication on important accounts (email, bank, social); where passkeys are supported, use them — they resist phishing and are the future.
The bottom line
The new rules are actually easier: length beats complexity, every site gets a unique password, and stop changing them on a schedule. The practical combo: generate 16+ character passwords with a generator, store them all in a password manager, and add MFA or passkeys on important accounts. Do those three and your security jumps a level — with less hassle than memorising weird passwords ever was.
FAQ
How long should a strong password be?
8 characters is no longer enough. Per current guidance (NIST, 2026), if a password is your only login factor, aim for at least 15 characters; with multi-factor authentication (MFA) you can go as low as 8, but longer is still better, up to 64+. The key idea: length beats complexity. A 20-character passphrase is harder to crack than a complex 8-character password — and far easier to remember.
Do I really not need to force uppercase, numbers and symbols anymore?
Right — it's a real shift. Forcing every character type pushes people toward predictable passwords like 'Password1!'. The current advice is to win on length instead: use a long passphrase, e.g. a few unrelated words strung together. You can still add symbols, but 'long enough' matters more than 'has every character type'.
Should I change my password every three months?
Not unless there's evidence of a breach. The old 'force periodic changes' rule backfired — people just changed Pass1 to Pass2, which is easier to guess. Current guidance: set one strong, unique password per site and don't keep changing it; only change it immediately if you suspect or confirm a breach.
How do I remember so many long, unique passwords?
Don't — use a password manager. It generates and stores a long, unique strong password for every site, and you only remember one master password. Security experts strongly recommend password managers as the practical way to have both 'strong' and 'unique per site'. Better still, enable passkeys where supported — they resist phishing and are the future.