Strong password examples
These were made at random for this page. They show what strong looks like, but since they are now public, don't use them.
| Example | Kind | Why it's strong |
|---|---|---|
| d6RGccrAwrEzwycC | Random characters | 16 random letters and numbers, no words or patterns |
| zsRU3@*wWdW&7KEFF8mQ | Random with symbols | 20 random characters, for sites that ask for symbols |
| atlas fluffy leaf silky brook snowy | Passphrase | Six random words, long and easier to type |
Never use a password you've seen on a website, even a strong one. Published examples can end up on the lists attackers try first.
Weak passwords to avoid
| Weak pattern | Why it's weak |
|---|---|
| A dictionary word, like sunshine | NIST says sites should block dictionary words and passwords from past data breaches, because they are common or already known |
| A word with a capital and a number, like Password1 | NIST notes people respond to rules in predictable ways: someone who picks password is likely to pick Password1 when asked for a capital and a number |
| A pet's name or a birthday | CISA says birthdays and pet names are not safe |
| A song lyric or a movie quote | The FTC says common phrases, song lyrics and movie quotes are easy for a hacking program to guess |
| The site's name or your username | NIST lists both among the passwords sites should block |
| A password you use somewhere else | If one site leaks it, every account that shares it is open |
How to make a strong password
- Make it long. NIST says a password that is the only thing protecting an account should be at least 15 characters. CISA suggests at least 16, adding "longer is stronger."
- Make it random. Let a generator pick the characters or the words instead of choosing them yourself. Passwords people make up follow patterns, like a word with a number on the end, and attackers try those first.
- Use it for one account only. CISA says to use "a different strong password for each account," so one leak can't open the rest.
- Save it in a password manager. CISA recommends one: it stores your passwords and fills them in, so you only remember one strong password, the one for the manager itself.
- Turn on a second sign in step. The FTC says a hacker who steals your password "can't log in to your account without another authentication factor," and an authenticator app or security key is safer than a code by text or email.
The FTC puts the problem plainly: "Studies show that people aren't very good at creating random, strong passwords, or remembering them." That's why a generator and a password manager work so well together. The Password Generator makes a random 16 character password as soon as the page opens, made in your browser and never sent anywhere.
Why length matters most
NIST says "password length is a primary factor in characterizing password strength." Every random letter or number you add multiplies the possible passwords by 62, so a few extra characters make a huge difference.
| Random password | Possible passwords |
|---|---|
| 8 lowercase letters | About 209 billion, a 12 digit number |
| 8 letters and numbers | About 218 trillion, a 15 digit number |
| 12 letters and numbers | A 22 digit number |
| 16 letters and numbers | A 29 digit number |
That's why 16 random letters and numbers is plenty for most accounts, even without symbols. These numbers only hold for random passwords. A password you make up yourself, like a word with a number on the end, is far easier to guess than its length suggests.
Random characters or a passphrase?
Both are strong when they are random. CISA suggests either "a random string of mixed-case letters, numbers and symbols" or a passphrase, "a memorable phrase" of 4 to 7 unrelated words. The FTC adds that the words must be random, never a common phrase, a song lyric or a movie quote.
- Random characters pack the most strength into the fewest characters, which helps on sites with a length limit. Best when a password manager fills it in for you.
- A passphrase is longer but easier to remember and type, so it suits the one password you type by hand, like your password manager's. The EFF suggests six words picked from its list of 7,776 by rolling dice, which gives a 24 digit number of possible passphrases.
Do you need symbols and capitals?
Not for strength. NIST tells sites not to demand a mix of character types and to block common passwords instead, because rules like that lead to Password1 rather than to anything random. Length and randomness matter more. Some sites still insist on a symbol, so turn symbols on in the generator when a site asks.
Should you change your password regularly?
No, only when there's a reason. NIST says sites should not make people change passwords on a schedule, but should force a change when there's evidence a password was exposed. The FTC says if a company tells you it lost your password in a data breach, "change your password right away," and change it on any other site where you used the same or a similar one.