What Makes a Password Strong in 2026

Ask ten people what makes a password strong and most of them will recite the same formula: uppercase, lowercase, a number, a symbol, eight characters minimum. That advice was reasonable in 2005. In 2026 it is somewhere between incomplete and misleading.

Password strength is not about how strange a password looks. It is about a number called entropy, about how attackers actually work, and about the unglamorous habits that matter far more than clever character substitutions. This article explains the real picture.

The math behind password strength

Every password can be measured in bits of entropy. The idea is simple: if a password could be any one of N equally likely possibilities, its entropy is the base-2 logarithm of N. A password with 50 bits of entropy has about a quadrillion possibilities; 60 bits has about a quintillion.

Entropy is what stands between you and a guessing attack. If an attacker can try a billion guesses per second, which is realistic for a well-funded operation with modern hardware, a 40-bit password falls in about eighteen minutes. A 60-bit password would take the same attacker roughly thirty-six years. Notice that adding just 20 bits turned minutes into decades. That exponential payoff is the single most important fact in password security.

The formula also tells you what actually creates entropy. Each character in a password contributes entropy based on the size of the pool it is drawn from. A lowercase letter drawn from 26 possibilities contributes about 4.7 bits. A character drawn from a pool of 90 common keyboard characters contributes about 6.5 bits. So you can raise entropy two ways: use a bigger pool, or use more characters. And because length multiplies while pool size only adds, length wins.

Length beats complexity, every time

Compare two passwords. The first is eight characters drawn from the full 90-character pool: about 52 bits of entropy. The second is twenty characters drawn from lowercase letters only: about 94 bits. The second password looks childishly simple and the first looks properly serious, yet the simple-looking one is roughly four trillion times harder to guess.

This is why the US National Institute of Standards and Technology revised its guidance years ago. The modern recommendation is to allow long passwords, stop demanding arbitrary complexity rules, and stop forcing regular password changes. Complexity rules mostly produce passwords like P@ssw0rd1, which look strong to a human and are trivially weak to software that knows every common substitution.

The practical takeaway: aim for length first. Sixteen characters is a sensible minimum for anything important; twenty or more is better. Complexity is a bonus, not the foundation.

Passphrases: the practical middle ground

A passphrase is a password built from ordinary words, like correct-horse-battery-staple (a famous example you should not actually use). Four or five random words from a modest word list give you 50 to 70 bits of entropy while remaining typable and memorable.

Passphrases solve the human problem that long random strings create. A 20-character string of symbols is strong, but if you have to type it on a phone keyboard or read it over a call, you will hate it, and passwords people hate get written on sticky notes. A passphrase of five common words is pleasant to type, easy to remember for a master password, and mathematically serious.

The critical word is random. Words you choose yourself, a lyric, a quotation, your street plus your dog's name, are not passphrases in the security sense. Attackers try exactly those patterns first. Let a generator pick the words from a real word list.

What attackers actually do

Here is the uncomfortable truth: most accounts are not compromised by someone guessing the password character by character. They are compromised by credential stuffing, where attackers take username-password pairs leaked in one breach and try them on other sites, and by phishing, where you are tricked into handing the password over willingly.

This changes the priorities. A unique 60-bit password reused on three sites is far weaker in practice than three unique 45-bit passwords. Uniqueness beats raw strength, because the most likely attack is not brute force against your password, it is replay of a password you used somewhere else.

Brute force still matters in one specific case: when the attacker has the password hash, for example from a breached database, and can guess offline at billions of tries per second with no rate limiting. That is when your entropy number does the real work. For everything else, uniqueness and phishing resistance matter more.

The tool stack that makes it effortless

Nobody can remember fifty unique 20-character passwords, and you should not try. A password manager remembers them for you, generates new ones, and fills them in so you never type them where a keylogger or a fake login page could grab them. The master password protecting the manager is the one password worth making a strong passphrase.

For the second layer, turn on two-factor authentication everywhere it matters, especially email, banking, and the password manager itself. An authenticator app or a hardware key beats SMS codes, which can be intercepted, but any second factor is vastly better than none. With 2FA enabled, even a leaked password is usually not enough to get into your account.

Finally, check whether your credentials have already leaked. Breach-notification services let you search your email address against known breach databases. If an old password of yours appears, change it everywhere you used it, starting with email, since email access unlocks password resets for nearly everything else.

What to do this week

You do not need to fix everything in one sitting. Work through this list in order and you will have covered the highest-value ground.

Then make it a habit: every new account gets a generated password from the manager, and 2FA goes on before you store anything valuable behind the login.

• Install a reputable password manager and move your most important logins into it, starting with email and banking.
• Generate new, unique passwords of at least 16 characters for those critical accounts.
• Turn on two-factor authentication for email, banking, and the password manager itself.
• Check your email addresses against a breach database and rotate anything that has leaked.
• Pick one strong passphrase as your manager's master password, and memorize that one properly.

Frequently asked questions

Conclusion

A strong password in 2026 is long, unique, randomly generated, and stored in a manager behind two-factor authentication. Entropy is the math, uniqueness is the strategy, and the manager plus 2FA is what makes the whole thing livable. Get those three right and the old complexity rituals can finally retire.