How to Create a Strong Password You Can Actually Use

To create a strong password, make it long, unique to one account, and hard for another person or automated guessing tool to predict. The easiest safe method is to use a password manager to generate a random password, then protect that account with multifactor authentication or a passkey.

That advice is different from the old “add a capital letter, a number, and a symbol” rule. Current NIST password guidance focuses more on length, uniqueness, blocklists of known-bad passwords, and better authentication controls than on forcing users into awkward composition tricks. A password like Coffee!2026 looks busy but is still predictable. A password manager’s random string or a long unrelated-word passphrase is stronger.

The short version

Use this rule:

1. Use a password manager for most accounts.
2. Let it generate a random password of at least 16 characters when the site allows it.
3. Never reuse that password anywhere else.
4. Turn on multifactor authentication, preferably an authenticator app, security key, or passkey.
5. Replace passwords that were reused, exposed in a breach, shared with someone else, or saved in an unsafe place.

If you need a password you can memorize, use a long passphrase made from unrelated words. Do not use song lyrics, famous quotes, your address, your pet’s name, your team, your birthday, or a predictable pattern with substitutions. Reused passwords are also the raw material for credential stuffing attacks, so uniqueness matters as much as unpredictability.

What makes a password strong?

A strong password has 4 traits: it is long, unique, unpredictable, and still usable without shortcuts that weaken it.

Password style	Example	Use it?	Why
Common pattern	Summer2026!	No	Seasonal words, years, and punctuation patterns are easy to guess.
Personal detail	MiloMainSt2026	No	Names, places, teams, schools, and birthdays are discoverable.
Reused password	Same password across accounts	No	One breach can unlock every account using it.
Long passphrase	maple-river-canvas-lantern-silver	Yes, if unique	Length and unrelated words make it easier to remember and harder to guess.
Manager-generated	Random 16+ character string	Best	It removes human patterns and can be unique on every site.

Length matters because every extra character expands the number of possible guesses. Uniqueness matters because many real account takeovers start with password reuse, not with someone “cracking” your exact password from scratch.

NIST’s current SP 800-63B-4 guidance is written for digital identity systems, not as a consumer checklist, but the practical lesson is clear: systems should allow long passwords, check passwords against known-compromised or otherwise weak values, avoid arbitrary composition rules, and avoid routine forced changes unless there is evidence of compromise. For you, that means a longer unique password is more important than a short password with clever-looking symbols.

How to create one step by step

1. Start with the account’s risk

Protect your email first. Your email account resets passwords for banking, shopping, social media, cloud storage, phone accounts, and work tools. If someone controls your inbox, they can often take over other accounts.

After email, prioritize financial accounts, password managers, cloud storage, phone carrier accounts, tax portals, domain registrars, social accounts with payment access, and any account tied to work or family safety.

2. Use a password manager for random passwords

For most accounts, the right answer is not to invent a password. Let a password manager generate one. A good default is a random password of at least 16 characters, longer if the site accepts it. You do not need to memorize it because the manager stores and autofills it.

This is where many people get stuck: they try to build one “perfect” password and reuse it. That is the wrong goal. You want many different passwords, each strong enough that a breach at one service does not endanger the rest of your accounts.

3. Use a passphrase only when you must memorize it

For a password you must type without a manager, build a passphrase from unrelated words. Make it long, avoid a sentence that appears in a book or song, and do not include personal facts.

Better:

harbor-linen-orbit-velvet-magnet

Worse:

ILoveNewYork2026!

The better example uses unrelated words. The worse example has a phrase, a place, a year, and a punctuation habit that many people use.

4. Turn on multifactor authentication

A strong password is still only one factor. Multifactor authentication adds another proof, such as a code from an authenticator app, a hardware security key, a passkey, or a trusted device prompt.

The FTC’s current phishing guidance tells consumers to protect accounts with multifactor authentication, and CISA continues to push phishing-resistant MFA in 2026 security alerts. The strongest options are passkeys or hardware security keys because they are designed to resist fake login pages. SMS codes are better than password-only login, but they are not the strongest fallback.

5. Replace weak passwords in the right order

You do not need to fix every account in one night. Start with:

1. Email.
2. Password manager.
3. Banking and payment apps.
4. Cloud storage and device accounts.
5. Social media and messaging.
6. Shopping accounts with saved cards.
7. Old accounts you still care about.

Change any reused password immediately. If an account alerts you to suspicious login activity, change that password and any similar password on other sites.

What to avoid

Do not build passwords from public or guessable information. That includes names, birthdays, addresses, schools, teams, employers, license plates, pet names, usernames, and fragments from your email address.

Do not rely on substitutions like @ for a, 0 for o, or ! at the end. Attackers know those patterns. They also know calendar patterns like month names plus the current year.

Do not store passwords in plain notes, spreadsheets, screenshots, browser bookmarks, email drafts, or chat messages. If you must share access with a spouse, family member, or coworker, use a password manager’s sharing feature instead of texting the password.

Do not change a strong unique password every few weeks just because of a calendar reminder. Change it when there is a reason: reuse, breach notice, phishing attempt, shared access that should end, device compromise, or a service telling you the account may be at risk.

Where passkeys fit in 2026

Passkeys are no longer experimental. Google, Apple, and Microsoft all have current support pages or product guidance for creating and using passkeys, and the FIDO Alliance reported in 2026 that passkey use has reached mainstream scale.

A passkey replaces the shared secret model of a password. Instead of typing a reusable string into a website, you approve sign-in with your device, password manager, security key, face, fingerprint, or device PIN. The important security benefit is that a passkey is tied to the real site or app, which makes it much harder for a phishing page to steal something reusable.

Use a passkey when the account offers it and you understand how recovery works. Before turning off a password entirely, make sure you have a second trusted device, a recovery method, or a hardware key registered. Locking yourself out of an email or financial account is its own security problem.

Passwords, VPNs, and what each one protects

A password protects an account. A VPN protects data in transit by creating an encrypted tunnel between your device and the VPN service. They solve different problems.

Use strong passwords and MFA to stop account takeover. Use a VPN when you want safer browsing on public Wi-Fi, less exposure to local network snooping, or a more private connection through an internet provider or hotspot operator. For a plain-English primer, read our guide to what a VPN is.

If you want one VPN pick to pair with better account hygiene, start with NordVPN. Its 2026 pricing page shows plans vary by term and bundle, so check the current checkout price before buying; our full NordVPN review covers who it fits best.

A practical password cleanup plan

Open your password manager or browser password list and search for reused passwords. Change the reused ones on your highest-risk accounts first.

Next, replace short passwords on important accounts with generated passwords. Then turn on MFA. If an account supports a passkey, add one and confirm you have a recovery path.

Finally, delete accounts you no longer need. Every forgotten account with a reused password is another place where an old breach can become a new problem.

FAQ

How long should a strong password be?

Use at least 16 characters when a site allows it. Longer is better, especially for passphrases. For accounts that matter, a password manager-generated random password is usually safer than a human-made password.

Is a passphrase better than a password?

A passphrase can be better if it is long, unique, and made from unrelated words. It is not better if it is a famous quote, lyric, personal phrase, or sentence someone could connect to you.

Should I change my passwords regularly?

Change passwords when there is a reason: breach notice, reuse, phishing risk, shared access, suspicious login, or device compromise. Routine calendar-based changes can lead people to choose weaker patterns.

Are passkeys safer than passwords?

Passkeys are usually safer for accounts that support them because they are phishing-resistant and do not require you to type a reusable secret into a login page. Keep recovery options up to date before relying on them for critical accounts.

Can a VPN replace strong passwords?

No. A VPN can help protect your connection, especially on untrusted networks, but it does not stop someone from logging in with a stolen or reused password. Use both for different layers of protection.