How to Create Strong Passwords That Are Actually Practical

Updated 2026-08-01 · 6 min read

Most password advice people remember is a decade out of date, and some of it actively made things worse. Here is what actually determines whether a password holds up, and a system that does not require memorising nonsense.

Length beats complexity

The rule that mattered most turns out to be the simplest. Each additional character multiplies the number of possibilities an attacker must try, and that multiplication compounds far faster than adding symbol variety to a short password.

A twelve-character password drawn from a full character set is dramatically harder to brute-force than an eight-character one, and the gap widens enormously at sixteen. If you change one thing about your passwords, make them longer.

Why "P@ssw0rd1!" fails

It satisfies every classic requirement: uppercase, lowercase, number, symbol, eight characters. It is also among the first things any real attack tries.

The reason is that attackers do not guess randomly. They start with lists of leaked passwords, then apply the exact substitutions humans predictably make: a becomes @, o becomes 0, i becomes 1, append a number, append an exclamation mark. Those transformations are built into cracking tools. A predictable pattern applied to a common word adds almost nothing.

This is why composition rules backfired. Told to add a symbol, nearly everyone adds "!" at the end. Told to add a number, nearly everyone adds "1" or the current year. The rules produced passwords that look complex to a human and are trivial to a machine.

Passphrases: long and memorable

Several unrelated words strung together give you length without impossible memorisation. Something like "correct-battery-staple-harbour" is far longer than a typical password and considerably easier to recall.

The critical requirement is that the words must be genuinely random, not a phrase you chose because it means something. Song lyrics, film quotes, and common sayings are all in attack dictionaries. "To be or not to be" is not a strong passphrase regardless of length.

Reuse is the real vulnerability

Here is the uncomfortable part: the strength of your password often does not matter, because the most common way accounts get compromised has nothing to do with guessing.

When a company suffers a breach, attackers obtain email and password pairs. They then try those same pairs on banks, email providers, and shopping sites, automatically and at enormous scale. This is called credential stuffing, and it works because most people reuse passwords.

If you reuse one password across ten sites, your security across all ten is determined by the least careful of them. A perfect password used everywhere is weaker in practice than mediocre passwords used once each.

A workable system

Use a password manager. This is the honest answer to an impossible problem. Nobody can remember forty unique long passwords. A manager generates and stores them, so you memorise exactly one strong master password.

Memorise only the few that matter. Your password manager's master password, your primary email, and your device login. Make these long passphrases. Everything else can be random strings you never see.

Turn on two-factor authentication. On important accounts this matters more than password strength, because it means a stolen password alone is not enough. An authenticator app is meaningfully safer than SMS codes, which can be intercepted through SIM-swapping.

Stop rotating passwords on a schedule. Guidance moved away from forced periodic changes because they push people toward predictable increments: Summer2024 becomes Summer2025. Change a password when there is a reason to, such as a breach notification or a suspicion it was exposed.

Checking your exposure

Breaches are public knowledge, and reputable services let you check whether your email appears in known incidents. If it does, change the password for that service and anywhere you reused it. Many password managers monitor this automatically and flag reused or compromised entries.