How to Create a Strong Password: Length, Random Words and a Manager

By Thomas Lovas Lokoy · Published October 25, 2026 — researched and drafted with AI assistance from published sources; edited and published by NorwegianSpark SA.

A strong password is a long one that nobody could guess and that you use nowhere else. The quickest way to make one you can remember is to string together random, unrelated words, three or more, and to let a password manager generate and remember a different password for every other account. Forget the old rules about capitals, numbers and symbols: the current US standard, NIST SP 800-63B-4, forbids services from forcing them, and the UK's National Cyber Security Centre (NCSC) recommends long passwords made of random words because they are strong enough and far easier to remember.

This guide is the practical follow-up to the password rules NIST now forbids. That article covers what services may no longer demand of you; this one covers how to make a password that clears the new bar.

Length beats complexity

NIST is direct about it. Appendix A of SP 800-63B-4 says password length is a primary factor in characterising password strength, and that passwords that are too short yield to brute-force and dictionary attacks. Length matters most in an offline attack: when a service is breached and its stored password hashes are stolen, NIST notes that attackers can compute many billions of hashes per second, with no rate limit to slow them down.

Complexity rules do far less than they appear to. The same appendix explains that people respond to composition rules in very predictable ways: someone who would have picked "password" picks "Password1" when told to add a capital and a number, and "Password1!" when a symbol is also required. Attackers know those habits. The NCSC makes the same point about swapping letters for look-alike numbers, such as a zero for an o: criminals know these tricks too, so the password is not significantly stronger, only harder for you to remember.

The practical floor comes from section 3.1.1.2. Services must require at least 15 characters for a password used on its own, may accept shorter passwords only when they are one factor in a multi-factor sign-in (and then at least 8), and should allow at least 64 characters. They should also accept the space character and Unicode, so a passphrase with spaces between the words is fine wherever a service follows the standard.

Method one: three random words

The NCSC's advice for most people is to combine three random words. Its examples include coffeetrainfish, walltinshirt and applenemobiro. Its reasoning is that this produces a password that is long enough and strong enough for most purposes while staying memorable, whereas memorising lots of complex passwords full of symbols is close to impossible for anyone with many accounts.

Three rules make the method work:

• The words must be random to you. Avoid phrases, lyrics and anything connected to you. The NCSC specifically warns against significant dates, favourite sports teams, and family or pet names, because most of those can be found on social media.
• Avoid the obvious. The NCSC names "onetwothree" as a choice that is memorable but easy to guess, and common passwords such as "password", "123456" and "qwerty" are the first things attackers try.
• Count the characters. Three short words can land under NIST's 15-character floor. Coffeetrainfish is exactly 15 characters; walltinshirt is 12. If the password is the only thing protecting an account, add a fourth word or choose longer ones.

Writing it down is acceptable. The NCSC says that if you want to write your password down, that is OK provided you keep it somewhere safe.

Method two: a dice-generated passphrase

For the handful of passwords that protect everything else, such as your password manager's master password or the encryption on a laptop, it is worth going further. The Electronic Frontier Foundation (EFF) publishes a method that removes human bias from the choice entirely: roll five dice, look the result up in its long word list, write the word down, and repeat until you have six words.

The EFF calculates that a six-word passphrase made this way is one of about 2 to the power of 77 possible alternatives, which makes it very hard to guess by brute force, and it recommends a minimum of six words from its long list. It describes passphrases like this as especially suitable for full-disk encryption and for unlocking a password manager. Two cautions from the same page: use the passphrase for one purpose only, and if you write it down while you memorise it, keep the paper somewhere safe and not in the same place as the data it protects.

Method three: let a password manager do the rest

Nobody can memorise a unique 15-character password for every account, and reuse is what turns one site's breach into a break-in everywhere. The NCSC encourages password managers because they can create strong passwords for you and remember them. NIST goes further: services SHALL allow password managers and autofill, and SHOULD allow pasting into the password field.

That gives you a simple division of labour:

• Memorise only a few passwords: the master password for your manager (a dice passphrase is ideal), your email account, and perhaps your device login.
• Let the manager generate everything else, long and unique for every site.
• Turn on two-step verification for the manager and for your email. The NCSC says this means that even a criminal who knows your password still cannot get in.

The password manager built into your browser or phone counts. The NCSC says saving passwords in the browser is safe on your own devices, should never be done on a shared computer in a library or college, and is only as secure as the devices and accounts behind it. A dedicated manager adds syncing across different browsers and operating systems. Our best password managers guide compares the main options, are password managers safe? answers the usual worry, and NordPass and Proton Pass are two managers we link to.

Check it has not already leaked

A long password is useless if it is already on a breach list, because attackers try known passwords first. NIST requires services to compare every new password against a blocklist of commonly used, expected or compromised passwords, including passwords from previous breaches, dictionary words, and words specific to the service such as its name or your username.

You can run the same check yourself. Have I Been Pwned's Pwned Passwords service uses a model called k-anonymity: your password is hashed on your device and only the first five characters of the SHA-1 hash are sent, so the password itself never leaves your device. Our Breach Radar password check works the same way. If a password shows up, stop using it everywhere you used it.

What to stop doing

• Reusing passwords. The NCSC is clearest about email: a criminal who gets into your email can reset the passwords for all your other accounts. Give your email a strong password you use nowhere else.
• Building passwords from personal details such as birthdays, family names, pets or teams.
• Swapping letters for numbers or adding a symbol at the end to satisfy an old rule. It adds little.
• Changing passwords on a calendar. NIST says services SHALL NOT require periodic changes. Change a password when there is evidence it has been compromised.
• Relying on hints and security questions. NIST does not allow password hints that someone who is not signed in can see, and does not allow services to prompt for knowledge-based questions such as the name of your first pet when you choose a password.

Where passwords are heading

Passwords are not the end state. The NCSC now recommends making passkeys your first choice of login wherever they are offered, and keeping a strong, unique password with two-step verification for accounts that do not offer them yet. Our passkeys explainer covers how they work, and the two-factor authentication guide covers the second step for everything that still runs on a password.

The short version

Make passwords long rather than complicated: three or more random words, at least 15 characters for anything protected by a password alone, and six dice-chosen words for your password manager. Use a different password for every account by letting a manager generate them, check that the ones you keep have not already leaked, and add two-step verification to your email and your manager first. This is general guidance; an employer or a service may set its own rules.

Continue in this collection

Best Security Tools

The shortlist across antivirus, VPN and password managers, and the reasoning.

Explore

Live Offers

What is actually discounted right now, rather than what once was.

Explore