Strong Password Examples

Half an hour. That's how long it takes to crack an eight-character random password, if the site storing it screwed up the hashing. Not screwed up in some dramatic way. Just used something fast and old, because nobody updated the login code since 2014 and nobody's going to tell you that.

Here's a password I generated a minute ago: c*rlfXR8Jg#EE}LJ. Sixteen characters, every one of them random. Don't use it. It's dead the second it's published anywhere, which is basically every "strong password examples" page on the internet in 2026 — they show you the sample, and the sample becomes a wordlist entry by lunchtime.

So what actually matters is the recipe. Not the output.

Why strong passwords still matter, even with passkeys everywhere

Passkeys get a lot of press. Biometrics too. And yet most of the accounts you actually log into today, your email, your bank, that one gym app you forgot you signed up for, still run on a password as the first lock on the door.

Which matters more now than it used to, honestly, because the tools attacking that lock got a lot better. Cracking software doesn't brute-force blindly anymore — it's trained on hundreds of millions of real leaked passwords, so it knows people swap an "a" for an "@" and stick a "1" at the end, and it tries those patterns first. That's not guessing. That's pattern recognition running at GPU speed, and it makes anything predictable fall in seconds.

Then there's reuse, which is arguably the bigger problem. One password leaked from some site you forgot existed, tried automatically against your email, your bank, your everything else — that's called credential stuffing, and it's still behind a huge share of account takeovers. Breach databases with billions of real passwords in them mean attackers frequently skip the "guessing" step entirely. If your password's already in one of those piles, none of the entropy math below saves you.

Two-factor authentication helps. It genuinely does. But it's a second lock, not a replacement for the first one — a weak, reused password with 2FA bolted on is still a weak, reused password most of the time.

Bits, and why they're the only honest measurement

Strength has a unit. It's called entropy, measured in bits, and it's really just asking: how many guesses does someone need before they land on yours?

For a randomly generated password it's length times log base 2 of your character pool. Ugly formula, simple idea. Lowercase letters alone give you 4.7 bits per character. Add uppercase, that's 5.7. Add digits and symbols on top of everything, you're at 6.46 bits a character, and that number barely moves no matter how creative you get with the symbol choices.

What counts as strong in 2026, in plain terms:

• 14 characters minimum, 20 or more if you can manage it
• Unrelated words, or fully random characters — nothing a stranger could guess from your Instagram
• No personal info. None
• No common substitutions (the @ for a, the 0 for o — cracking tools check these first, automatically)
• Never reused, anywhere, ever
• Sitting in a password manager instead of your memory

Twelve characters using all four sets gets you to about 77.5 bits. Adequate, not great — fine for a newsletter signup, not fine for your email. Sixteen characters lands around 103 bits, a comfortable, forgettable default. Push to twenty and you're at 129, more security than any realistic attacker needs, though it costs you nothing to type since your password manager does the typing for you anyway.

And here's the part that trips people up: none of this math works if the password isn't actually random. P@ssw0rd123! technically spans all four character sets across twelve characters. Should be 77 bits. Isn't. It's a dictionary word with the substitutions everybody makes, plus a number stuck on the end where everybody sticks it. Cracking software has these substitution rules built in by default, called mangling rules, and they're older than most of the passwords they break. Real strength on that one is closer to 10 bits.

It depends on the site, not on you

This is the reframe that actually matters, and it rarely gets said out loud: your password's strength depends on how the website stores it, and you have zero visibility into that decision.

Take one eight-character random password. Against a fast, unsalted hash, the kind still floating around in old databases, that's a thirty-minute crack on average, using consumer GPU hardware. Against bcrypt, tuned properly, the same password takes something like 570 years. Same password. Same entropy. Different fate, entirely dependent on a backend decision you'll never see.

For a quick sense of scale:

Sixteen characters against the bad hash is still 210 billion years. Against the good hash, absurd numbers that don't mean anything to a human brain anymore. Which is really the whole argument for going long — you're not securing the password for the site that did storage right. You're securing it for the site that didn't, and won't tell you.

A friend of mine found out her old forum account from 2011 was in a breach dump last year. Same password she still used, slightly modified, for three other things. That's the actual risk model most people are living in without knowing it.

Passphrases vs. random passwords

You can't memorize sixteen random characters with a bracket and a pipe symbol in it. Nobody can. For the two or three passwords you genuinely have to hold in your head, device login, password manager master key, use words instead. Everything else should be random and generated, because you'll never type it by hand.

The method's called Diceware. Roll dice, or let software do it, and pick words off a list of 7,776 options. Each word is worth about 12.9 bits.

• Four words gets you 51.7 bits, same ballpark as eight random characters
• Six words. The usual floor for something you actually rely on, like orbit-lantern-ocean-jazz
• Seven words, 90.5 bits — better, and honestly not that much harder to type than six
• Eight if you're the paranoid type, which, fair enough

Three things break a passphrase if you get them wrong. The words have to be chosen randomly — words you pick yourself aren't random, people gravitate toward the same handful of nouns without realizing it. Don't turn it into a sentence; "correct horse battery staple" works because the words have nothing to do with each other, and a grammatical phrase is easier to guess than four strangers standing next to each other. And don't bother substituting characters in the words themselves. Swapping an o for a zero adds under two bits. A whole extra word adds thirteen. Do the math on which is worth your time.

Building one by hand, step by step

If you're not using a generator for some reason, or you just want to understand the shape of a good one, the formula's simple enough to do in your head.

Start with a passphrase base. Four unrelated words, chosen randomly, not picked because they mean something to you. tulip-river-orange-satellite, something like that.

Add one unpredictable twist. A symbol in an odd spot, a capital letter where you wouldn't expect one, maybe a digit. tulip-river_orange-Satellite7. Small change, but it breaks any dictionary match on the phrase itself.

Skip anything personal after that — no birthdays, no pet names, no keyboard walks like qwerty or 1qaz2wsx. And don't reuse it. Ever. Recycling a password, even a genuinely strong one, is one of the fastest routes to getting an account taken over, because the moment it leaks once, it's compromised everywhere you used it.

The whole thing, stacked: passphrase, plus a twist, plus something small and account-specific if you want an extra layer (a word related to the site, maybe, though a manager makes this step unnecessary).

What current guidance actually says

NIST rewrote its password guidance a while back, SP 800-63B if you want to look it up, and a lot of what still gets repeated on forums and help desks is now flatly wrong.

Forced character mixing, the "must contain a symbol" box, got dropped, because it just pushes everyone toward Password1!. Scheduled password expiry got dropped too, because when people are forced to rotate every ninety days they don't generate something new, they increment. Summer2024 becomes Summer2025. Attackers know this pattern cold. Length caps of sixteen or twenty characters are gone; systems are now supposed to accept at least 64. Security questions, mother's maiden name and all that, are out entirely.

The rotation thing is worth sitting with for a second, because it's genuinely counterintuitive. Forcing regular changes was supposed to help. It made things worse. People are predictable under that kind of pressure in a way that's almost funny, if it weren't a security hole.

Common password mistakes, even in 2026

• Leetspeak. p@$$w0rd is on every cracking wordlist that exists. The substitution rules are free for attackers to apply.
• Keyboard patterns — qwerty, zxcvbnm, the diagonal ones too — enumerated in standard attack dictionaries, not hidden gems.
• Slapping a number and an exclamation point on the end. Dolphins1! clears most complexity checkers and falls in under a minute, because suffix patterns are the very first thing tried.
• Reusing a strong password anywhere. This one's sneaky because the password itself is genuinely strong right up until one site leaks it, and then credential-stuffing bots try that exact pair against a few hundred other services within hours.
• Trusting phishing pages by accident. A fake login screen doesn't care how many bits of entropy you have — it just asks you to type the password in, and you do, because it looked exactly like the real site.
• Writing it down, weirdly, isn't as bad as people think. A password on a sticky note in your actual wallet is safe from someone in another country trying to guess it remotely, which is the threat most people are facing. I could be wrong here, but the "never write it down" rule seems aimed at office environments circa 1998, not how most people get compromised today.

Check if yours already leaked

Have I Been Pwned has a password checker that doesn't actually send your password anywhere. It hashes it locally, sends only the first five characters of that hash, and compares the rest on your end. Clever bit of engineering, and worth using even if you're fairly confident.

If it shows up even once, it's already in the wordlists everyone uses. Change it. Change it everywhere you reused it too, which, be honest, is probably more places than you remember.

Why a password manager is doing most of the real work here

You can't manually create or remember strong logins for a hundred-plus accounts. Nobody can, and nobody should try. A manager handles the parts a human brain isn't built for.

It generates genuinely random, unique passwords for every single account, no repeats, no patterns a wordlist would catch. It keeps them behind encryption you're not managing yourself. It autofills only on the real site, which quietly kills a huge share of phishing attempts, since a fake login page at a slightly wrong domain just won't get an autofill offer. It syncs across your phone and laptop so you're never locked out because the password's stuck on the other device. And increasingly, it handles passkeys too, sitting alongside your regular logins as that transition slowly plays out.

Relying on one is, at this point, just the realistic way to manage a digital life with more than a dozen accounts in it. Which is all of us.

Are passwords becoming obsolete?

Short answer: not yet, and probably not for a while.

Passkey adoption is real and growing, but most of the internet hasn't caught up. Plenty of smaller sites and apps haven't implemented it at all. Older enterprise systems, the kind still running your dentist's scheduling software or your city's utility billing portal, are often years behind on this stuff, if they ever get there. Even services that do support passkeys usually keep a password as the fallback for account recovery, because losing your only passkey device and having no backup is its own kind of disaster. Government sites, university logins, aging SaaS tools that haven't been touched since 2018 — all still password-first, and likely to stay that way for a good while yet.

So passkeys are where things are heading. Passwords are just still doing most of the actual work right now, and a manager is the thing that bridges the two, holding your old logins and your new passkeys in the same place while the rest of the internet slowly catches up.

Settings, if you're using a generator

Length matters more than anything else in the box. Sixteen is a fine default, but bump it to twenty for anything tied to money or your inbox — the inbox is the reset path for basically every other account you own, so it deserves the extra characters.

Turning off symbols costs less than you'd think, actually — dropping them from a sixteen-character password takes you from 103 bits down to about 95, still nowhere near reachable. And if you're going to be reading the password aloud or typing it on a phone screen, flip on "exclude ambiguous characters." Losing the letter I and the number 1 costs you almost nothing and saves you from retyping the thing four times because you can't tell an l from a 1 on your phone at 11pm.

Passwords generated properly, in the browser, using crypto.getRandomValues, never touch a server. Open the network tab while it generates one, if you don't believe it — you'll see nothing go out. A generator that phones home has already shown your password to someone else before you've even used it once.

Fourteen characters minimum. Twenty where it counts. Random over clever. Unique everywhere. Stored somewhere other than your memory. That's really the whole list, and the tool does the remembering so you don't have to.