How to Create a Strong Password (The Rules Changed)
Length beats symbols, forced password changes are out and passphrases are in. What the latest official guidance says, in plain English.
Remember being told to use something like P@ssw0rd! and change it every 90 days? That advice is officially out of date.
The US National Institute of Standards and Technology (NIST), whose password guidance shapes security rules worldwide, updated its digital identity guidelines (SP 800-63B, Revision 4) in 2025. Here's what changed, and what it means for you.
The new rules in plain English
1. Length matters most
A long password is much harder to crack than a short complicated one. NIST's guidance says that where a password is the only thing protecting an account, it should be at least 15 characters. Systems should also allow passwords of at least 64 characters.
2. No more forced symbol rules
The guidance says organizations shouldn't require arbitrary mixes like "one uppercase, one number, one symbol". Those rules pushed people toward predictable passwords like Summer2026!, which attackers try first.
3. No more changing passwords on a schedule
Forced resets every few months made people pick weaker passwords and add a number at the end. The new advice: change a password when there's evidence it's been compromised, not on a calendar.
4. Block known bad passwords
Systems should check new passwords against lists of breached and common passwords, like 123456, qwerty and iloveyou, and reject them.
How to make a strong password you can remember
Use a passphrase: several random, unrelated words.
correct-river-pencil-autumn
That's 27 characters, easy to remember and very hard to guess, as long as the words are genuinely random and not a famous quote or song lyric.
Tips:
- Pick words randomly. Your brain is bad at randomness. Many password managers can generate passphrases for you.
- Four or five words is a good length.
- Don't use personal facts: your pet's name, your street, your birthday.
The real answer: you only need to remember one or two
You shouldn't be memorizing dozens of passwords. Nobody can, which is why people reuse them, and reuse is the real danger. When one site leaks, attackers try that email and password everywhere else.
So:
- Use a password manager to generate and store a unique random password for every site. See 1Password vs Bitwarden.
- Memorize one strong passphrase for the password manager itself.
- Memorize one for your main email (or store it safely too).
- Turn on two-factor authentication for important accounts. See how to set up 2FA properly.
- Use passkeys wherever a site offers them. They replace passwords entirely.
Check if your passwords have leaked
Most password managers can check your saved passwords against known data breaches. Google's and Apple's built-in password managers do too. If something shows up, change that password and anywhere you reused it.
