Toolkeel

What makes a password strong in 2026 (and what no longer matters)

Current, evidence-based password advice: length beats complexity, use a password manager, never reuse passwords, and turn on two-factor authentication.

Security2 min readUpdated

Key takeaways

  • Length matters more than symbols: a random 16-character password is far stronger than a short complex one.
  • Never reuse passwords. Data breaches make reused passwords the most common way accounts are taken over.
  • Use a password manager to generate and store unique passwords.
  • Turn on two-factor authentication, ideally an authenticator app or passkey rather than SMS.
On this page
  1. Why length wins
  2. The real risk: reuse
  3. What to do
  4. Myths

Why length wins

Attackers guess passwords by trying enormous numbers of combinations. Each extra character multiplies the work. A random 8-character password using every keyboard symbol has about 52 bits of entropy; a random 16-character one has about 105 bits, which is not twice as hard to crack but trillions of times harder. The password generator shows the entropy of each password it creates.

Current guidance from the US National Institute of Standards and Technology (NIST SP 800-63B) reflects this: prefer long passwords, check them against known-breached lists, and stop forcing users into arbitrary complexity rules and regular changes, which tend to produce predictable patterns like Summer2026!.

The real risk: reuse

Most account takeovers do not involve clever guessing. Criminals take email and password pairs leaked from one website and try them on others ("credential stuffing"). If you reuse a password, one breach anywhere opens every account that shares it. A unique password per site removes that risk.

What to do

  1. Use a password manager (many browsers include one, and dedicated managers sync across devices). It creates and remembers a unique password for every site.
  2. Make one strong master password you can remember. A passphrase of four or more random words (the UK National Cyber Security Centre suggests "three random words" as a minimum) is long and memorable.
  3. Turn on two-factor authentication for email, banking and social media. Authenticator apps and passkeys are stronger than SMS codes.
  4. Change a password immediately if a service tells you it was breached. Otherwise there is no need for routine changes.

Myths

  • "Replacing letters with symbols makes it secure." P@ssw0rd is in every attacker's list.
  • "Online generators are unsafe." A generator that runs in your browser and never transmits the password is safe; one that generates passwords on a server is not ideal.
  • "Hashing a password with MD5 protects it." Websites should store passwords with slow, salted algorithms such as bcrypt, scrypt or Argon2, never plain MD5 or SHA hashes.

Sources

  1. NIST SP 800-63B: Digital Identity Guidelinespages.nist.gov
  2. UK NCSC: Three random wordsncsc.gov.uk
Written by the Toolkeel team at Sole Digital Media

Fact-checked against the sources above. We test every tool we mention. Editorial policy.

Read next