How to Create a Strong Password: Length, Passphrases and MFA

A strong password is long, random and unique to one account. Current US government guidance favors length over complexity: CISA recommends at least 16 characters, such as a random string from a password manager or a passphrase of 5–7 unrelated words.

Length and uniqueness matter far more than swapping letters for symbols. Add multi-factor authentication (MFA) to important accounts and you're protected even if a password leaks.

Quick answer

• Make it long: Aim for at least 16 characters. Longer is stronger.
• Make it unique: Use a different password for every account.
• Make it random: Let a password manager generate it, or use 5–7 unrelated words as a passphrase.
• Skip the old rules: You don't need forced symbols or regular password changes. Change a password when it may have been exposed.
• Use a password manager to create, store and fill your passwords.
• Turn on MFA for email, banking, health and other important accounts.

What Makes a Password Strong?

Attackers rarely guess passwords by hand. They use software that tries huge lists of common passwords, leaked passwords and predictable patterns. A strong password beats these tools in three ways.

1. Length. Every extra character multiplies the number of possible combinations. That's why both NIST and CISA focus on length.
2. Randomness. Words, names, dates and keyboard patterns like "qwerty" are the first things attackers try. Truly random choices are much harder to crack.
3. Uniqueness. When a website is breached, criminals try the stolen email and password on other sites. If you reuse passwords, one breach can unlock many accounts.

What current guidance says

The US National Institute of Standards and Technology (NIST) writes the password rules many organizations follow. Its digital identity guidelines say services should:

• Require passwords of at least 15 characters when the password is the only way to sign in, or at least 8 characters when it's used with MFA.
• Allow passwords of at least 64 characters.
• Not force mixtures of character types, like "one uppercase, one number, one symbol."
• Not force regular password changes, but require a change if there's evidence the password was compromised.
• Check new passwords against lists of common or previously breached passwords.
• Allow password managers, autofill and pasting.

The Cybersecurity and Infrastructure Security Agency (CISA) gives similar advice to the public: at least 16 characters, a different password for each account, and a password manager to do the work.

How to Create a Strong Password, Step by Step

Option 1: Let a password manager generate it (best)

1. Choose a reputable password manager. Many browsers and phones include one, and standalone apps are also available.
2. Protect the manager with a long, unique master password or passphrase and turn on MFA for it.
3. When you create or update an account, use the manager's generate password option.
4. Set the length to at least 16 characters. If a site allows it, go longer.
5. Save it in the manager. It will fill the password for you next time, so you never need to memorize it.

Option 2: Create a passphrase you can remember

Use this for the few passwords you must type from memory, such as your computer login or your password manager's master password.

1. Pick 5–7 unrelated words. The more random, the better. Avoid song lyrics, quotes and anything about you.
2. Choosing words by chance (for example, by rolling dice against a word list or opening a dictionary at random pages) is stronger than picking words that "feel" random.
3. String them together, with or without spaces or a separator if the site allows: for example, lantern-gravel-oyster-tundra-pickle. (Don't use this example. It's now public.)
4. Check that it's at least 16 characters long. Most five-word passphrases easily pass that.
5. Use it for one account only.

Option 3: Improve an existing weak password

1. Start with your most important accounts: email, banking, and any account that can reset others.
2. Replace short or reused passwords with a generated password or a new passphrase.
3. Turn on MFA while you're in the account's security settings.
4. Work through the rest over time, using your password manager's list of reused or weak passwords as a to-do list.

Weak vs. Strong Passwords

The table shows patterns, not real passwords. Never use an example password from any website.

Turn On Multi-Factor Authentication (MFA)

MFA adds a second step at sign-in, so a stolen password alone isn't enough. CISA recommends turning it on for email, banking, healthcare and other important accounts. Your email comes first, because anyone who controls it can reset your other passwords.

Common MFA methods include:

• Authenticator apps that show a new code every 30 seconds.
• Codes sent by text or email. Better than no MFA, but CISA notes that text and voice codes are vulnerable to phishing and SIM-swap attacks, so treat them as a last resort.
• Biometrics, such as a fingerprint or face scan.
• FIDO-based sign-in, such as a physical security key. CISA calls FIDO/WebAuthn the only widely available phishing-resistant method.

To set it up, look in the account's Security or Sign-in settings for options like "two-step verification" or "multi-factor authentication." Save the backup codes somewhere safe.

Common Mistakes to Avoid

• Reusing passwords. This is the biggest risk. One breach can expose every account that shares the password.
• Relying on character swaps. Replacing "a" with "@" or adding "1!" at the end is predictable, and cracking tools try it automatically.
• Using personal information. Pet names, birthdays and favorite teams are easy to find online.
• Writing passwords in an unprotected note or spreadsheet. Use an encrypted password manager instead.
• Sharing passwords or MFA codes. Real companies never ask for your password or a sign-in code by phone, text or email. Learn how to spot online scams and phishing.
• Changing passwords on a schedule for no reason. NIST no longer recommends forced periodic changes, which often lead to small, predictable edits. Change a password when there's a sign it was exposed.

Frequently Asked Questions

How long should a strong password be?

CISA recommends at least 16 characters, and longer is better. NIST says services should require at least 15 characters when a password is the only sign-in factor. A password manager makes long passwords easy.

Are passphrases really safer than complex passwords?

A long passphrase of truly random words is usually stronger than a short password full of symbols, and it's far easier to remember. Length adds more strength than complexity rules.

Should I change my passwords regularly?

Current NIST guidance says you don't need to change passwords on a fixed schedule. Change one immediately if a service reports a breach, you notice suspicious activity, or you shared it by mistake.

Are password managers safe?

A reputable password manager protected by a strong master password and MFA is far safer than reusing passwords or writing them down. It also makes it practical to use a unique password everywhere.

What should I do if my password was in a data breach?

Change that password right away, plus any account where you used the same one. Turn on MFA and review recent account activity. If the account was used for money, check statements too.

Is it safe to let my browser save passwords?

Built-in password managers in major browsers and phones are a reasonable choice for many people, especially with a device lock and MFA turned on. Before you clear your browser cache, make sure you aren't also deleting saved passwords you depend on.

---

Sources

• NIST SP 800-63B – Digital Identity Guidelines: Authentication and Authenticator Management
• CISA Secure Our World – Passwords Tip Sheet
• CISA Secure Our World – Turn On Multifactor Authentication
• CISA – Implementing Phishing-Resistant MFA (fact sheet)