How to make a strong password: length, a password manager and two-step verification

A strong password has three things going for it: it is long, it is random and it is used in only one place. The complexity that sign-up forms ask for (a capital letter, a digit, a symbol) comes a distant fourth. Below is the arithmetic behind that, what the US agency CISA and the standards body NIST say, and a short list of what to do today.

How long does it take to guess a password?

Passwords are cracked fastest after a data breach. The attacker does not have to fool anyone: they take the stored fingerprints (hashes) of the passwords and try possibilities one after another. The speed depends on how the service stores them. On a fast hash (MD5), one NVIDIA RTX 5090 graphics card manages 215.8 billion guesses a second in published hashcat benchmarks; on the slow bcrypt, only 255.3 thousand.

Password	Strength	Slow hash (bcrypt)	Fast hash (MD5)
8 characters, lowercase letters only	38 bits	5 days	under a second
8 characters, all kinds of characters	50 bits	57 years	35 minutes
12 characters, all kinds of characters	76 bits	over 1 billion years	4,300 years
16 characters, all kinds of characters	101 bits	over 1 billion years	over 1 billion years
20 characters, all kinds of characters	127 bits	over 1 billion years	over 1 billion years

Three things stand out:

• Eight characters are not enough, even with every kind of character. On a fast hash such a password falls in 35 minutes, on a slow one in 57 years. Eight lowercase letters on a fast hash: under a second.
• Twelve characters is a different league. The password has 76 bits, and a fast hash would take 4,300 years on average.
• From sixteen characters it is out of reach. 101 bits means over 1 billion years on a fast hash. Every extra character multiplies the time.

The numbers hold only for a random password. One you make up is much weaker: people choose predictable words, names, dates and a digit at the end, and attackers try exactly those first.

Why length beats complexity

With 81 different characters (lowercase and uppercase letters, digits and symbols), every extra character multiplies the number of possibilities by 81. Adding four characters to a twelve-character password therefore adds 26 bits, while switching on symbols in a twelve-character password of letters and digits adds only 4.4.

The guidance reflects this. The US National Institute of Standards and Technology (NIST SP 800-63B-4, section on passwords) says:

• a password used as the only way to sign in must be at least 15 characters; if it is only one part of multi-factor authentication, at least 8;
• services should accept passwords of at least 64 characters and allow pasting, so that password managers work;
• services must not impose composition rules (mixing kinds of characters) or periodic password changes; a change is forced only when there is evidence of compromise;
• a new password is checked against a list of common and compromised passwords.

CISA, the US cybersecurity agency, asks for at least 16 characters ("longer is stronger"), random and unique for every account. It allows two ways to get there: a random string of mixed-case letters, numbers and symbols, or a passphrase of 4 to 7 unrelated words. Both agencies agree that what matters is length and that passwords must not be reused.

Random, not made up

Humans are bad at randomness; a generator is not. The password generator draws every character from your browser's cryptographic random source and never sends or saves the password. The result has nothing to do with you, so it cannot be worked out from your name, birthday or anything an attacker knows about you.

One password per account

When one service leaks its database, attackers try the leaked passwords on other services. If you use the same or a similar password everywhere, one leak opens every account. A different password for each account limits the damage to one.

A password manager

Nobody can remember dozens of long random passwords. A password manager stores them, fills them in and leaves you remembering one master password. CISA recommends one for exactly this reason. For the master password, a longer sentence or several words you can remember but nobody would guess works well. Words drawn at random work best, for example with the passphrase generator. Never use it anywhere else, and keep a recovery code somewhere safe.

Two-step verification and passkeys

Two-step verification adds a second step to the password, such as a code from an app or a physical key, so a stolen password alone is not enough. CISA asks for it especially on email, social media and financial accounts.

Passkeys go further. According to the FIDO Alliance you sign in the same way you unlock your device (biometrics, a PIN or a pattern), and because they use public-key cryptography there is no password in a database to steal and nothing for a fake site to trick you into giving away. Use them wherever a service offers them.

What to do after a leak

Change the leaked password immediately, and everywhere you reused it. Turn on two-step verification. You can check whether your email address appears in leaked databases at Have I Been Pwned.

What to do today

1. Install a password manager (or switch on the one in your browser or phone) and give it a long master password.
2. Start with the passwords for your email, bank and the password manager: generate them at 16 characters or more.
3. Turn on two-step verification for email and your bank.
4. Gradually replace passwords you use in more than one place.
5. Keep recovery codes for your accounts somewhere safe.

This is not security advice for your particular situation. A password is only one part of protecting an account and does not protect against phishing or malware by itself.