How to Choose a Password That Actually Holds Up

The password rules most of us learned — one capital, one number, one symbol, change it every 90 days — came from a single 2003 document published by the US National Institute of Standards and Technology. Its author, Bill Burr, later told the Wall Street Journal he regretted it. “Much of what I did I now regret.”

The rules didn’t make passwords stronger. They made them predictable. Told to add a capital and a number, people capitalise the first letter and add “1” at the end. Told to change it quarterly, they increment to “2”. Attackers know this, and cracking tools have encoded these patterns for years.

NIST rewrote the guidance in 2017. Most websites haven’t caught up.

What actually makes a password strong

Two things: how many characters it could have been, and how many it is.

That’s it. This is measured in bits of entropy, and every extra character multiplies the search space:

Password	Possible combinations	Time to crack offline*
8 chars, lowercase only	2 × 10¹¹	Under a second
8 chars, mixed + symbols	6 × 10¹⁵	~17 hours
12 chars, mixed + symbols	5 × 10²³	~170,000 years
16 chars, mixed + symbols	4 × 10³¹	Longer than the universe
4 random common words	2 × 10²⁰	~70 years
5 random common words	4 × 10²⁵	~13 million years

* Assuming 100 billion guesses per second — a well-funded attacker with GPUs, attacking a stolen database that used fast hashing.

Notice what dominates: length. Going from 8 to 12 characters helps far more than adding symbols to an 8-character password.

The substitutions don’t work

Replacing “a” with ”@” and “o” with “0” felt clever in 2005. Cracking tools have applied those transformations automatically for twenty years.

P@ssw0rd! is not meaningfully stronger than password. It’s on every wordlist. So is Tr0ub4dor&3, Summer2024!, and every variation of your pet’s name with a birth year.

If a human can think of the pattern, a rule engine has already enumerated it.

Random string or passphrase?

Both are fine. Use each where it fits.

Random strings — k9#mQ2vX!pL4nR8w — are maximally strong per character and completely unmemorable. That’s fine for the 200 accounts your password manager fills in automatically. You will never type them.

Passphrases — harbor-lantern-drift-copper — are for the handful you must type by hand: your password manager’s master password, your laptop login, your Wi-Fi key, anything you’ll enter on a games console or a TV remote.

Four random words from a large list carry roughly the entropy of a 12-character random string, and you can type them without swearing.

The crucial word is random. “correct horse battery staple” is famous, which makes it worthless. The words must be chosen by a random process, not by you — human-chosen words cluster around a predictably small vocabulary.

Reuse is the actual vulnerability

Here’s the uncomfortable part: most account compromises don’t involve cracking anything.

An attacker takes a username and password from a breached site — and billions of these pairs are freely circulating — and tries them everywhere else. It’s called credential stuffing, it’s cheap, it’s automated, and it works because most people reuse passwords.

Your strongest password becomes worthless the moment it’s stored in plain text by some forum you signed up to in 2014 and forgot about.

A unique password per site contains the damage to one account. That’s impossible from memory across a hundred sites, which is exactly what password managers exist to solve.

Do these things, in this order

1. Turn on two-factor authentication

This matters more than any password decision. Even a compromised password usually can’t get past a second factor.

Ranked by strength: hardware key (YubiKey and similar) > authenticator app (Aegis, Authy, 1Password, Google Authenticator) > SMS codes. SMS is vulnerable to SIM-swap attacks, but it is still enormously better than nothing.

Start with your email, your bank, and your password manager.

2. Secure your email first

Your email account can reset the password on almost everything else. It is the master key whether you think of it that way or not. Give it your strongest passphrase and your strongest second factor.

3. Use a password manager

Any reputable one — Bitwarden, 1Password, KeePass, or the one built into your browser. The one you actually use beats the theoretically superior one you don’t.

You remember one strong passphrase. It remembers everything else, and generates a different 20-character random string for every site.

4. Check whether you’ve been breached

Enter your email addresses at Have I Been Pwned. If an account appears, change that password — and anywhere else you used the same one.

5. Stop rotating on a schedule

Change a password when there’s a reason: a breach, a suspicion, a shared device. Forced quarterly rotation produces weaker passwords, not stronger ones, and NIST now explicitly recommends against it.

What about passkeys?

Passkeys replace passwords with a cryptographic key pair stored on your device and unlocked by your fingerprint or face. There is nothing to phish, nothing to reuse, and nothing to leak in a breach — the site only ever holds a public key.

Where a site offers passkeys, take them. They are genuinely better in every dimension. Support is still uneven, so a password manager remains necessary for everything else, but this is where things are heading.

The realistic summary

• Length beats complexity. 16 random characters, or 4–5 random words.
• Uniqueness beats strength. A different password everywhere matters more than any single one being perfect.
• Two-factor beats both. If you do one thing today, do this.
• Protect your email like it’s everything, because it is.
• Let software do it. A password manager makes all of the above automatic instead of aspirational.

You don’t have to be uncrackable. You have to be enough trouble that the automated attack moves on to someone else — and almost nobody is being individually targeted.