What makes a password strong
Strength comes from unpredictability and length. Every extra random character multiplies the number of guesses an attacker must try, so a long password is exponentially harder to crack than a short clever one. Randomness matters too — a password built from unrelated words or characters resists the dictionaries and patterns attackers use first. The measure people cite is entropy, roughly how many bits of surprise the password contains.
The numbers behind that are simple. Each random character drawn from the full keyboard set (letters, digits, symbols — about 95 possibilities) adds roughly 6.6 bits of entropy. Each random word drawn from a 7,776-word list adds about 12.9 bits, whether or not it contains a capital letter. Twenty bits of entropy is a joke; sixty is respectable; anything above seventy-five is out of reach of ordinary cracking rigs.
One distinction separates professionals from advice-column writers: where the guessing happens. Against an online login form, an attacker is rate-limited and a decent password plus two-factor authentication holds indefinitely. Against a stolen password database, the attacker runs hash-cracking software offline at billions of guesses per second per graphics card — and there, entropy is the only thing between you and the plaintext. Serious advice is written for the offline case, because breaches leak databases constantly.
Why length beats complexity
A password like "Tr0ub4dour&3" looks complex but is only 12 characters and follows a predictable pattern, so cracking tools handle it quickly. A passphrase like "correct-horse-battery-staple" is longer, all lowercase, and far harder to break because its length dominates the math. Complexity helps, but length wins. Aim for 16 or more characters when you can.
That exact comparison comes from XKCD comic 936, published in 2011, and "correct horse battery staple" has since become the standard teaching example in security training. The comic's insight was not that symbols are bad; it was that humans substitute predictably. Leetspeak substitutions are so automated that every major cracking rule set applies them by default: hashcat's best64 rules, built partly from analysis of real leaked password lists like the 32-million-password RockYou dump of 2009, try the @-for-a and 0-for-o versions of every dictionary word within the first minutes of an attack. Your substitution is not clever to a machine. It is a rounding step.
Run the actual math once and the hierarchy becomes obvious: a 16-character fully random string from the full keyboard set carries roughly 105 bits of entropy; a six-word passphrase from a 7,776-word list carries about 77 bits; "P@ssw0rd!" carries so little that it is functionally zero, because it is on every list the attackers already own. Both legitimate options crush the clever-looking one.
When you need a strong one
- Email and banking — the keys that unlock everything else, since a reset sent to a compromised inbox compromises everything downstream.
- Work and admin accounts where one breach spreads — a WordPress admin login bypasses the platform's own HTML sanitization, making it a site-wide risk.
- Any account with saved payment details.
- New signups where the default you pick gets reused elsewhere.
- After a breach notice for any service you used — and not just that one account, if the password was shared anywhere.
How to create one well
Use a generator that produces random characters or word combinations, not one you invent by hand — human-chosen passwords carry patterns. Make it long, unique to that account, and never a reused favorite. Store it in a password manager so you do not have to remember it, and turn on two-factor authentication where offered. The generator should run locally so the value is never transmitted.
The passphrase method, step by step
The passphrase is the strong password a human can actually hold in memory:
- Pick four or more unrelated words — "canyon", "lantern", "spoon", "mercury". Four random words from a 7,776-word list already carry about 51 bits; five words push past 64.
- Choose the words randomly, not by mood. This is the step people skip and it is the whole ballgame. When asked to pick random words, humans cluster: animals, foods, swears, and words from the same semantic neighborhood — "cat" pulls "dog" along behind it. Cracking dictionaries are built from exactly those clusters. The old-school fix is physical dice: roll five dice per word and look up the result in the EFF Diceware wordlist (published at eff.org/dice).
- Join them however you like. Hyphens, spaces, capitals — the separators add a little entropy, but the randomness of the words is doing the work.
- Use it as your master password. The passphrase is the one password worth memorizing, because it unlocks the manager that holds everything else.
What NOT to do
- No personal information. Pet names, birthdays, street addresses — the first things an attacker tries, and most of it scrapes off your social media in minutes.
- No substitutions as a strategy.
@forais in every cracking rule set on earth, as shown above. - No reuse across sites. One breach then unlocks every account sharing it.
- No passwords from movies, songs, or books. "letmein", "opensesame", and half of song lyrics are dictionary entries already.
- No clever patterns. "Summer2026!" feels unique and is tried early — season-plus-year is a template, and templates are what rule sets are made of.
What NIST actually recommends
The current federal guidance — NIST Special Publication 800-63B, first published in its modern form in 2017 — reversed decades of password folklore:
- Length over composition rules. No forced exclamation marks or capital letters; minimum eight characters, and users should be allowed up to at least 64.
- No forced periodic rotation. Changing passwords every 90 days pushes people toward "Password1", "Password2", and increments of the same — NIST says change only on evidence of compromise.
- Check against breach lists. New passwords should be compared against catalogs of already-breached passwords and rejected if found.
That third point is the quiet revolution: any password a criminal already has is worthless regardless of its appearance — the idea behind services like Have I Been Pwned.
A step-by-step method
- Open a browser-based generator that creates values on your device, never transmitting them.
- Choose length of 16+ characters for stored passwords, or 4+ random words for the one passphrase you memorize.
- Generate and copy — do not type a pattern you invented, and do not "improve" the output by hand. Hand-editing re-introduces the human patterns the generator just removed.
- Save it in a manager so each account gets a unique value. The manager autofills, which also protects you from phishing: it will not autofill your bank password into a lookalike domain.
- Enable two-factor authentication on the account as a second line of defense.
Choosing the second lock: TOTP app vs SMS
Two-factor authentication is not one thing. Authenticator apps (TOTP — time-based one-time passwords, standardized in RFC 6238) generate a six-digit code every thirty seconds on your device, offline, with nothing to intercept. SMS codes are better than nothing but travel through the phone network, where a SIM-swap attack — a criminal convincing your carrier to port your number to their SIM — redirects them. SIM swaps are a documented criminal industry, and NIST's own guidance downgrades SMS to a restricted authenticator type for exactly this reason. Where a choice exists, use the app.
A worked example
The hierarchy of common password shapes, by real-world verdict:
123456— near-zero entropy; found at the top of every breach dump since dumps existed; broken instantly.Tr0ub4dour&3— looks strong, but leetspeak rules crack it fast; a lesson rather than a password.correct-horse-battery-staple— four random words, about 51 bits; strong and memorable.7Kq!m2$vNp9@wLxZ— sixteen random characters, roughly 105 bits; stronger still, and fine in a manager since nobody has to remember it.
Notice the ranking has nothing to do with how intimidating each looks. The symbol-laden short password loses to a lowercase phrase.
Common shapes compared
- Passphrase (4+ random words) — high strength, human-memorable; the right choice for master passwords and anything typed on a phone.
- Random string (16+ characters) — very high strength, meaningless to humans; the right choice for everything stored in a manager.
- Personal phrase (lyrics, quotes, names) — low strength despite feeling personal; dictionary attacks eat these first.
- Pattern password (substitutions, season-year) — weakest of all per unit of effort; automation targets patterns specifically.
A quick scenario: a small business owner
A small business owner uses one password everywhere because it is easy to remember. After a newsletter service he uses is breached, the same password unlocks his email and bank. He switches to a browser-based generator that creates a unique long value per account, stores them in a manager, and turns on 2FA. The next breach elsewhere costs him nothing, because that password opened nothing else.
The change takes an afternoon and removes his biggest risk. In the following months he stops dreading "another login to remember" because the manager handles it, and every account now has a value no attacker's dictionary could guess.
What he dodged has a name: credential stuffing. When any site is breached, the attackers and the bots that follow them replay the leaked email-plus-password pairs against hundreds of other login forms, counting on reuse. It is why a breach at a site you barely remember using can empty an account you care about. Checking your own email against known breaches (the Have I Been Pwned service, run by security researcher Troy Hunt) tells you which of your credentials have already appeared in a dump, and its Pwned Passwords database catalogs hundreds of millions of real breached passwords.
Common mistakes
- Reusing one password across accounts, so a single breach cascades through everything. This is the mistake from which all the others draw their power.
- Trusting a "clever" pattern like "Summer2026!" that attackers try early.
- Letting forced rotation degrade quality. If your workplace mandates 90-day changes and you are incrementing a base password, you are complying with a policy NIST itself retired — the safer habit is unique, long passwords plus immediate change on any breach notice.
- Writing passwords on a sticky note or in an unencrypted file — or in a spreadsheet named something innocent. Use the manager.
- Using an online generator that uploads the value to a server. The site then knows your password, which is the one thing it should never see.
- Answering security questions honestly. "Mother's maiden name" is public-record adjacent in 2026; give fictional answers and store them in the manager like passwords, because they are passwords.
Who should use it (and who shouldn't)
Everyone with an online account should use strong, unique passwords; there is no exception worth the risk. The only "shouldn't" is relying on memory alone for many of them — use a manager. The division of labor is clean: the generator makes randomness, the manager holds uniqueness, and you remember exactly one strong passphrase. Add an authenticator app as the second lock and you have the full stack that security professionals actually run.
And for anything sensitive, prefer a generator that runs locally so the value is never transmitted — a password that has crossed a server is a password you should regenerate.
How it fits a security toolkit
Glint's password generator creates values in your browser and never uploads them. Pair it with the API-keys guide for handling credentials safely, and the password strength guide for understanding the math behind a good value. All are free with no signup.
For the deeper material: the strong password generator guide walks through generation options, the password strength checker guide covers how strength is actually scored, and the API keys safety guide applies the same principles to developer credentials. The roundup of best free password generator tools compares the wider field.
Frequently asked questions
What is the strongest kind of password? A long random passphrase — 4 or more unrelated words or 16 plus random characters.
Is a password manager enough? It helps you store unique strong passwords; you still need to generate them well and turn on 2FA.
Should I include symbols? They help but length matters more; do not sacrifice length or a word for a symbol.
Why avoid reusing passwords? One breach then unlocks every account that shares it — that is credential stuffing, and it is automated.
Is the Glint generator free with no upload? Yes. It runs in your browser and never sends the value anywhere.