How to create a strong password (2026 guidance)

The advice most people follow — eight characters, one capital, one number, one symbol, changed quarterly — is not merely outdated. It is explicitly contradicted by the current guidance from the organisations that originally issued it.

Here is what replaced it, and why.

The rules, current as of 2026

NIST's SP 800-63B is what most password policies eventually derive from. Its requirements are unusually direct:

Notice how much of that is a prohibition on things you were told to do. Twenty years of evidence showed those rules made passwords worse by making them predictable.

Why length is what matters

Each character added to a password multiplies the number of possibilities. Each type of character added multiplies the size of the alphabet — once.

That asymmetry is the whole argument. Going from eight characters to fourteen does far more work than adding a symbol to eight, and it is also easier to remember and type. Length is the rare security measure that is simultaneously stronger and more usable.

The three random words method

The NCSC's public recommendation, and the best available approach for a password you actually have to remember.

Combine three unrelated words. Their own example is applenemobiro. It is long, it has no dictionary pattern to exploit as a unit, and you can type it.

Two conditions matter:

The words must be genuinely unrelated. redwhiteblue and bacon-eggs-toast are phrases, and phrases are guessable. orbit-crayon-thistle is not.

They must not come from your life. The NCSC is specific: avoid significant dates, sports teams, family and pet names — "most of these details can be found within your social media profile". This is the direct link to privacy: a password drawn from published facts about you is a password someone else has the ingredients for.

The three tiers of password

In practice you need three different approaches, not one.

Tier 1 — passwords you must remember (3 or 4 of them)

Your device login, your password manager's master password, possibly your primary email. These have to live in your head.

Use four random words for these, not three. They protect everything else.

Tier 2 — everything else (the other 200)

Let the password manager generate them. Twenty-plus random characters, unique per site, never seen and never typed.

This is the tier where most people's security is actually decided, and it is also the tier where willpower is a hopeless strategy. You cannot invent and recall 200 unique strong passwords. A generator can.

Tier 3 — passwords that should not exist

Anywhere passkeys are offered, take them instead. A passkey cannot be guessed, reused, phished or read out over the phone, because there is no secret to reveal.

Check what you already have

NIST requires services to compare new passwords against a blocklist of "commonly used, expected, or compromised" values. You can run that check on yourself at Have I Been Pwned, which tells you whether a password already appears in a breach corpus.

If one does, its length is irrelevant. A twenty-character password that has leaked is already in the dictionary attackers try first — see credential stuffing.

Stop changing them on a schedule

If your workplace still forces a quarterly change, it is running a policy NIST now prohibits. The reason is behavioural: told to change regularly, people increment. Summer2026! becomes Autumn2026!, which is not a new password in any sense that matters to an attacker.

Change a password when there is evidence it needs changing — a breach notification, a suspicious sign-in, a shared device. Not on a calendar.