How to create a strong password you can remember (2026)

To create a strong password, make it long, random and used in only one place. For a password you have to remember, pick five or six unrelated words at random. For everything else, let a password manager generate a random string of 16 characters or more. Length matters far more than symbols.

That is close to the opposite of what most of us were taught, which was eight characters with a capital, a number and a symbol, changed every 90 days. The US standards body that wrote those rules has withdrawn them.

What makes a password strong in 2026?

The current reference is NIST Special Publication 800-63B, revision 4, published in July 2025. It tells services how to handle passwords, and its reasoning applies to you directly:

• "Password length is a primary factor in characterizing password strength."
• A password that is the only thing protecting an account must be at least 15 characters. Where it is combined with a second factor, the floor is eight.
• Services should accept passwords of at least 64 characters, so that passphrases fit.
• Services "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)."
• Services "SHALL NOT require subscribers to change passwords periodically," and must force a change only when there is evidence of compromise.
• Every new password must be checked against a blocklist of common and breached passwords.

NIST explains why the character-mix rule had to go. People respond to it "in very predictable ways": someone who would have chosen "password" picks "Password1" when told to add a capital and a number, and "Password1!" when a symbol is required. Attackers try those patterns first.

So a strong password today has three properties. It is long. It is random, meaning a machine or dice chose it and you did not. And it is unique, so a breach at one site opens nothing else.

Old rules and current rules, side by side

Published advice has not all caught up, which is part of why this is confusing. As of October 2026:

When they disagree, follow the strictest length and ignore any instruction to rotate on a schedule.

How to create a strong password you can remember

Use this for the handful of passwords you must type from memory. The method is called diceware, and the point of it is that chance picks the words.

With a generator:

1. Open Secria's free passphrase generator. It picks words on your device from the EFF list of 7,776 words, and nothing is sent or stored.
2. Leave Number of words at 6.
3. Choose what goes Between the words: a hyphen, a space, a period or nothing.
4. If a site insists on a capital letter or a digit, tick Capitalize each word or Add a number.
5. Don't like the result? Click Generate another. Then Copy.

With dice, following the EFF's directions: roll five dice, read the numbers left to right as a five-digit number, and look up the word next to that number in the EFF Long Wordlist. Repeat until you have six words.

Either way you end up with something like panoramic-nectar-precut-smith-banana-handclap. It looks silly, and that is fine. To learn it, type it a few times a day for a week. Keep it on paper somewhere safe at home until it sticks, then destroy the paper.

Secria Mail uses the same idea for account recovery: when you create an account you receive a recovery phrase of 12 random words.

How to create a strong password you don't need to remember

This is every other account you own. Let a password manager create and fill these.

1. In the manager's generator, set the length to 16 or more. Go to 20 or beyond if the site allows it.
2. Keep all character types on. Here symbols cost you nothing, since you never type the password.
3. Save it in the manager and let it fill the login.

If a site rejects long passwords or strips symbols, use the longest it accepts and turn on two-factor authentication there.

How long should a password be?

Strength is measured in bits of entropy. Each extra bit doubles the number of guesses an attacker needs. The numbers below assume the password was chosen at random, which is the only case where the math holds.

One trillion guesses per second is a harsh assumption. It describes someone who has stolen a site's password database and is attacking it offline with serious hardware. A login page allows a few tries before it slows you down. Still, the table makes two points that survive any assumption. A "complex" eight-character password is no stronger than four plain words. And six random words match twelve characters of keyboard noise while being far easier to type.

A password you invented is weaker than these numbers suggest, often by a lot. Summer2026! has eleven characters and three character types, and it follows the exact pattern NIST describes attackers trying first.

What should I avoid?

• Anything about you. Names, birthdays, pets, your street, your team.
• Phrases that already exist. A lyric, a quote or a proverb was not chosen at random, so none of the math above applies to it. Random words do not form a sentence, and that is their strength.
• Swaps and suffixes. Replacing a with @, or adding 1 or ! to the end, are the predictable moves NIST describes, and guessing software knows them.
• Reuse, including "variations". One breach then exposes every account that shares the pattern.
• Keyboard walks and sequences. qwerty, 1234, asdfgh.

Which passwords do I need to memorize?

Three, for most people:

1. Your password manager.
2. Your main email account, since it can reset everything else.
3. The login for your computer or phone.

Give each its own six-word passphrase. Everything else lives in the manager.

How do I check if a password has already leaked?

Paste it into Pwned Passwords, part of Have I Been Pwned. The check is built so your password never leaves your device: the browser hashes it locally and sends only the first five characters of the hash, then compares the matches on your side. If a password shows up there, stop using it everywhere.

Password managers run the same kind of check on everything they store. Chrome's is called Password Checkup, and on an iPhone the Passwords app lists affected logins under Security.

Frequently asked questions

Is a passphrase better than a password?

For anything you must remember, yes. Six random words have about the same strength as twelve fully random characters and are much easier to recall and type. For passwords stored in a manager, a long random string is just as good, since you never have to type it.

Do I still need symbols and numbers?

Only where a site demands them. NIST's current guidance tells services not to require a mix of character types, because the requirement makes people choose predictable patterns. Adding length helps more than adding a symbol.

How often should I change my password?

When you have a reason: the site was breached, the password appears in a leak check, you shared it, or you typed it into a page you no longer trust. NIST tells services not to force changes on a schedule.

Is a strong password enough on its own?

No. A perfect password can still be captured by a phishing page or by malware. Add a second factor to every account that offers one, starting with email. We compare the options in is two-factor authentication safe.

Start with one

Replace the password on your main email account today with a six-word passphrase, then work outward from there. If you are setting up a new inbox while you are at it, Secria Mail is free to start and stores your mailbox with zero-access encryption.