Quick answer
Prioritize length and uniqueness.
For an important account, use a password manager to generate a long, random password that is used nowhere else. If you must memorize it, use a long passphrase made from unrelated words. Turn on MFA or a passkey, and replace the password if it is known to be compromised.
What “strong” actually means
Strength is not a single property. A password can look complicated and still be easy to guess if it follows a common pattern such as a word, year, and exclamation point. It can also be technically strong but operationally unsafe if the same value protects several accounts.
Current NIST guidance emphasizes long passwords, screening against commonly used or compromised values, allowing password managers and paste, and avoiding arbitrary composition rules. NIST SP 800-63B-4 requires at least 15 characters for passwords used as a single authentication factor in the systems covered by that standard. Individual websites may enforce different limits, but the underlying lesson is clear: length gives you more room to avoid guessable patterns.
A practical five-step method
- Make it unique. Never reuse the credential on another account.
- Make it long. Aim for at least 15–16 characters; longer is better when the service allows it.
- Make it unpredictable. Avoid names, dates, keyboard walks, quotes, and common substitutions.
- Store it safely. Use an encrypted password manager rather than a note, spreadsheet, chat, or repeated memory pattern.
- Add another factor. Prefer a passkey, security key, or authenticator app when the account supports one.
Random password or passphrase?
Random generated password
Best for accounts stored in a password manager. A generator can produce a long value without human patterns. You do not need to memorize it, so there is little reason to shorten it.
Memorable passphrase
Useful for the small number of secrets you may need to type or remember, such as a password-manager master password. Use several genuinely unrelated words and avoid familiar sayings, lyrics, personal facts, and predictable formatting.
What not to rely on
- Replacing “a” with “@” or adding “1!” to a dictionary word
- Incrementing a number each time a site forces a change
- Using a favorite quote, team, pet, birthday, or company name
- Assuming a password is safe because a meter turns green
- Reusing one excellent password across multiple accounts
A meter is feedback, not a guarantee. It cannot know every attacker's dictionary, whether you reused the password, or whether malware is watching the device.
Check without exposing the password
Our private password checker evaluates length and predictable patterns locally in your browser. The optional Pwned Passwords lookup runs only after you click and uses the k-anonymous range method: your browser sends only the first five characters of a SHA-1 hash, not the password or full hash.