What makes a strong password?
Length is the single most important factor. Modern NIST guidelines (SP 800-63B) recommend a minimum of 8 characters for user-chosen passwords, but for randomly generated passwords, 16 characters or more is ideal. Each additional character multiplies the number of possible combinations exponentially.
Complexity rules — requiring uppercase, lowercase, digits, and symbols — are less effective than simply increasing length. A 20-character lowercase-only password has more entropy than a 10-character password using all character types. That said, mixing character sets is still beneficial when length is constrained.
The passphrase approach is increasingly recommended: four to six randomly selected dictionary words (e.g. "correct-horse-battery-staple") produce a password that's both highly entropic and memorable. NIST now explicitly encourages passphrases and discourages forced complexity rules and mandatory password rotation, both of which tend to produce weaker passwords in practice because users resort to predictable patterns.
Whatever method you use, the golden rule is: never reuse passwords across accounts. A password manager makes this practical.
Password entropy explained
Entropy measures the randomness in a password, expressed in bits. The formula is E = L × log₂(C), where L is the password length and C is the size of the character set. A 16-character password drawn from 95 printable ASCII characters has about 16 × 6.57 ≈ 105 bits of entropy.
Security researchers generally recommend 80+ bits of entropy for important accounts and 128+ bits for cryptographic keys. At 80 bits, there are over 1024 possible passwords — enough to resist brute-force attacks for decades even with purpose-built hardware. This tool calculates entropy automatically and shows the result as a strength bar: weak (<40 bits), fair (40–60), strong (60–80), and very strong (80+).