Most "strong password ideas" you'll find online still tell you to swap an a for an @ and add an exclamation mark. Attackers have known those tricks for years. The advice from security agencies has moved on: length and randomness beat clever substitutions, and you shouldn't be remembering most of your passwords at all.
This guide collects practical strong password ideas that hold up in 2026, based on the latest guidance from the US National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA). You'll learn the passphrase method for the few passwords you must memorise, the habits that matter more than the password itself, and how to generate one in seconds with our free Password Generator.
QUICK ANSWER
A strong password is long (CISA says at least 16 characters), random and unique to each account. For passwords you must remember, use a passphrase of 4 to 7 unrelated random words. For everything else, let a password manager generate and store random passwords, and turn on multi-factor authentication.
What makes a password strong in 2026
Three things, and only three, according to CISA's "Use Strong Passwords" guide:
- Long: at least 16 characters. Longer is stronger.
- Random: either a random mix of letters, numbers and symbols, or a passphrase of 4 to 7 unrelated words.
- Unique: a different password for every account.
NIST's updated digital identity guidelines, SP 800-63B (revision 4, 2025), point the same way for the services you log in to. When a password is the only thing protecting an account, NIST says services should require at least 15 characters. It also tells services to stop forcing mixed character types and to stop making people change passwords on a schedule. Instead, a password should be changed when there's evidence it has been compromised, and services should check new passwords against lists of known breached and common passwords.
In plain terms: a long, boring-looking random string is far stronger than a short "complex" one like P@ssw0rd!, which appears in every attacker's wordlist.
Strong password ideas that actually work
1. Random words (a passphrase)
Pick 5 or more words that have nothing to do with each other and nothing to do with you. CISA's own example progression is HorsePurpleHatRun (good), HorsePurpleHatRunBay (great) and Horse Purple Hat Run Bay Lifting (amazing). Spaces are fine where a site allows them. Don't reuse those exact examples, of course; they're now public.
The key word is random. A phrase you chose because it sounds nice, like a song lyric or a favourite quote, is much easier to guess than words picked by a die or a generator.
2. A long random string from a generator
For the hundreds of accounts you never type by hand (shopping sites, forums, streaming services), use 16 to 20 random characters and let your password manager remember them. You'll never see most of them again, and that's the point.
3. A passphrase with a twist you'll remember
If a site insists on numbers or symbols, add them between words rather than at the end: maple 7 cobalt stairs ! orbit. Putting 1! at the end is the first thing cracking tools try.
Password ideas to avoid
- Personal details: names, birthdays, pets, sports teams, your street. These are often on social media.
- Keyboard patterns:
qwerty,1qaz2wsx,123456. - Predictable substitutions:
S3cur1ty!is not secure. - One password with a site name added:
MyPass-Amazon,MyPass-Netflix. One leak reveals the pattern. - Anything reused. CISA's guide tells the story of a person whose bank was drained after she reused a password that leaked in a company breach. Reuse turns one breach into many.
How to create a strong password with our free generator
The free Botvana Password Generator creates passwords with crypto.getRandomValues, the cryptographically secure random number generator built into modern browsers. Everything happens on your device; nothing is sent to a server.
- Open the generator and choose Random characters or Passphrase (words).
- For random characters, set the length to 16 or more and keep upper case, lower case, numbers and symbols switched on. Tick Avoid look-alikes if you'll ever read it aloud or type it from paper.
- For a passphrase, choose 5 or more words. Use this for your computer login and your password manager's master password.
- Check the strength meter. It estimates entropy in bits, so you can see why length matters more than symbols.
- Copy it straight into your password manager or the site's sign-up form. Don't paste it into notes, email or a spreadsheet.
Use a password manager (yes, really)
Nobody can memorise a unique 16-character random password for 100 accounts. CISA recommends a password manager for exactly that reason: it generates, stores and fills in passwords, and warns you about weak or reused ones. NIST's guidelines also tell websites to allow password managers, autofill and pasting, because people choose stronger passwords when they use one.
Free options include the managers built into Chrome, Safari (iCloud Keychain), Edge and Firefox. Paid managers add features like secure sharing and breach monitoring. Whichever you choose, its master password should be your best passphrase, and it's the one password worth memorising.
Add multi-factor authentication
Even a perfect password can be phished. Multi-factor authentication (MFA) means a stolen password alone isn't enough to get in. Turn it on for email first (whoever controls your email can reset everything else), then banking, social media and your password manager.
Where you can, choose an authenticator app or a passkey over SMS codes. Passkeys, now supported by Google, Apple and Microsoft accounts, replace the password with a cryptographic key on your device and resist phishing by design. If you run a small business, our guide to AI-driven attacks on small businesses explains why phishing is getting more convincing, and the Claude Code extension backdoor case shows how a single stolen credential can spread.
What to do after a breach
If a service tells you it was breached, change that password straight away, and change it anywhere you reused it. That's the situation where NIST says a change is genuinely needed.
Sources and further reading
- Use Strong Passwords (CISA)
- NIST Special Publication 800-63B (NIST)
FAQ
How long should a strong password be?
CISA recommends at least 16 characters. NIST's 2025 guidelines tell services to require at least 15 characters when a password is the only login factor.
Are passphrases better than complex passwords?
For passwords you must remember, yes. Four to seven random, unrelated words are long, hard to guess and easier to type than a short string of symbols.
Should I change my passwords every 90 days?
Not on a fixed schedule. NIST says services shouldn't force periodic changes; change a password when there's evidence it was compromised.
Is it safe to use an online password generator?
Use one that generates passwords on your device with a cryptographically secure random generator and doesn't send them anywhere, like the Botvana Password Generator.
What's the most important account to protect?
Your email, because it's used to reset almost every other account. Give it a unique passphrase and turn on multi-factor authentication.
Comments
Post a Comment