Password best practices in 2026

Most password advice people grew up with — mix in a capital letter, add a number, throw in a symbol — turns out to be a weaker strategy than the one thing it usually skips: length. A password's resistance to brute-force guessing grows exponentially with each additional character, which is why a long, random string beats a short, "complex-looking" one almost every time.

To see why, it helps to understand how passwords actually get attacked — because almost none of it looks like a stranger sitting at a login screen typing guesses.

How passwords actually get cracked

• Credential stuffing. Attackers take username-and-password pairs leaked from one breached site and try them on hundreds of other sites automatically. This is why reuse is the single most dangerous habit: the attacker doesn't crack anything, they just replay a password you used somewhere else.
• Offline cracking. When a site is breached, attackers often get the database of password hashes. They then run guessing hardware against those hashes at enormous speed, on their own machines, with no rate limits and no lockouts. This is the scenario where password length and randomness matter most.
• Dictionary and pattern attacks. Cracking tools don't guess randomly — they try dictionaries, leaked-password lists, keyboard walks like "qwerty123", and predictable mutations first: capitalise the first letter, swap a for @, append a year. If your "complex" password follows a human pattern, it's in the first wave of guesses.
• Phishing and malware. Sometimes there's nothing to crack — a fake login page or a keylogger captures the password directly. No amount of password strength helps here, which is why two-factor authentication exists.

Notice what this list implies: your password mainly needs to survive an offline attack against a leaked database, and it needs to be unique so a leak from one site can't be replayed against another. Those two requirements drive everything below.

Length versus complexity, with real numbers

Consider "P@ssw0rd!" — it has upper and lowercase letters, a number, and a symbol, so it looks strong by old-school rules. But it's only 9 characters, and it's built from a predictable pattern (a common word with obvious substitutions) that password-cracking tools are specifically trained to check first. Compare that to a random 16-character string like "xR7!qLm2*vDp9$wZ" — same character variety, but so much longer that it takes vastly more computing time to brute-force, even with modern hardware.

The practical takeaway: length is the lever that matters most. Complexity still helps, but only after you've already got enough length to work with.

Entropy, the number behind the advice

Security people measure password strength in bits of entropy — roughly, how many coin-flips of pure randomness a password contains. Each extra bit doubles the number of guesses an attacker needs on average, which is why entropy grows slowly with complexity but quickly with length.

The math is simple: each character contributes log₂ of the size of the character set it's drawn from. That works out to about 4.7 bits per lowercase letter, 5.95 bits per character when letters and digits are mixed, and about 6.5 bits per character with the full symbol set. Multiply by length:

As a working scale: around 70 bits is strong for online accounts (where rate limiting slows attackers down), and 100+ bits holds up even against fast offline cracking of a leaked hash. Our Password Generator computes this entropy figure live as you adjust length and character options, so you can see exactly where a given configuration lands.

One crucial caveat: these numbers assume the characters are actually random. "Summer2026!" is 11 characters, but its real entropy is tiny, because it's assembled from guessable parts. Entropy math only applies to passwords a machine picked, not ones a human composed.

A rule of thumb for different accounts

• General accounts (shopping, forums, subscriptions): 16+ characters
• Higher-stakes accounts (email, banking, work login): 20+ characters
• Never reuse a password across more than one site — a breach on one service becomes a breach on every service where you reused it

Passphrases, a more memorable alternative

If typing or recalling a random string feels impractical, a passphrase is a solid middle ground: a string of unrelated words, like "correct-horse-battery-staple-glacier". Four or five random words strung together is long enough to be very hard to brute-force, while being genuinely easier for a person to remember than a jumble of symbols.

The randomness of the word choice matters — a memorable quote or song lyric is a bad passphrase, because it's guessable in a way a truly random word sequence isn't. The gold standard is the diceware method: words are selected from a large list using dice rolls or a cryptographic random number generator, so each word contributes about 13 bits of entropy. Five diceware words gives roughly 65 bits; six gives about 78 — comparable to a strong random character password, but far easier to type on a phone keyboard.

Passphrases shine as master passwords and device logins: the handful of secrets you must actually remember and type. For everything else, random strings in a manager win.

Why you need a password manager

Here's the honest problem with "use a unique, long password for every account": nobody can remember dozens of them. That's not a willpower issue, it's a memory limitation, and it's exactly the problem password managers exist to solve.

A password manager generates random, unique passwords for every site, stores them encrypted, and autofills them when you need to log in. You only need to remember one strong master password (or use biometric unlock) to access the rest. This isn't a "nice to have" — it's genuinely the only realistic way to follow the "unique password everywhere" rule at scale.

There's an underrated bonus: autofill is phishing-resistant. A manager fills credentials only on the exact domain it saved them for, so a lookalike site with a subtly wrong address gets nothing — a check human eyes routinely fail.

What if the manager itself is breached? Reputable managers encrypt your vault locally with a key derived from your master password before anything is synced, so a stolen vault is useless without that master password. This design means the strength of your master passphrase is the one place you should over-invest — it's the root of everything else.

Two-factor authentication is not optional anymore

Even a great password can be exposed through phishing, a data breach on the service's end, or malware on a shared device. Two-factor authentication (2FA) adds a second check — a code from an app, a hardware key, or a push notification — so a leaked password alone isn't enough to get into your account.

Not all second factors are equal, though. From strongest to weakest:

1. 1Hardware security keys verify the site's identity cryptographically, which makes them effectively phishing-proof.
2. 2Authenticator apps generate time-based codes on your device; a phishing page can still trick you into typing one, but there's nothing to intercept in transit.
3. 3SMS codes are better than nothing, but they can be intercepted through SIM-swap attacks, where an attacker convinces a carrier to move your number to their SIM.

Enable 2FA everywhere it's offered, and prioritise your email account above all — email is the recovery path into nearly everything else you own.

Passkeys are changing the rules

The newest development worth knowing about is passkeys — a passwordless login standard now supported by major browsers, phones, and a growing list of sites. Instead of a shared secret, your device holds a private key and the site holds only the matching public key. When you log in, the device signs a challenge — unlocked by your fingerprint, face, or device PIN — and the site verifies the signature.

Two properties make passkeys genuinely better rather than just different: there's no secret on the server to steal in a breach, and a passkey only works on the real site it was created for, which makes classic phishing structurally impossible. Where a service offers passkeys, they're usually the strongest convenient option — and where it doesn't, a long random password plus app-based 2FA remains the standard to hold.

How sites should store your password

You can't control this as a user, but understanding it explains several habits worth having. A responsible site never stores your actual password — it stores a hash: the output of a one-way function that can verify your password without being reversible into it. Good implementations also add a salt (random data unique to each user, so identical passwords produce different hashes) and use a deliberately slow hashing algorithm, which turns high-speed guessing from billions of attempts per second into thousands.

You can see what one-way hashing looks like with our Hash Generator — put in any text and compare the SHA-256 output as you change a single character. Two things become obvious: the output reveals nothing about the input, and even a tiny input change produces a completely different hash.

What to do after a breach notification

Breach alerts are a matter of when, not if, so having a routine takes the panic out of it:

1. 1Change the breached account's password immediately — from a device you trust.
2. 2If you reused that password anywhere, change it there too. This is the step people skip, and it's the one credential-stuffing attacks count on.
3. 3Check that 2FA is enabled on the account and on your email.
4. 4Watch for targeted phishing. Breach data often includes names and emails, and attackers use them to write convincing follow-up scams referencing the breached service.
5. 5If payment details were involved, watch statements and consider a replacement card.

Password myths that refuse to die

• "Change your passwords every 90 days." Forced rotation without a specific reason pushes people toward weak, incremented passwords like "Password4". Modern guidance is to change passwords when there's evidence of compromise, not on a calendar.
• "Writing passwords down is always terrible." A notebook in a drawer at home is invisible to every online attacker on the planet. It doesn't scale, and it's wrong for shared spaces — but it's far safer than reusing one password everywhere.
• "The complexity meter said it was strong." Meters mostly measure character variety, and many rate "P@ssw0rd2026!" as strong. Patterns beat symbols; length and randomness beat both.
• "I'm not important enough to be targeted." Credential stuffing is fully automated and doesn't care who you are. Every reused password is tried against every major service eventually.

Signs your password habits need an update

• You use the same password (or small variations of it) across multiple sites
• Your passwords are based on personal information — birthdays, pet names, addresses
• You've never checked whether an email address of yours appears in a known data breach
• You don't have 2FA enabled on your email account specifically — email is often the recovery path into everything else

Generate a strong password

Our Password Generator creates cryptographically random passwords using your browser's crypto.getRandomValues API — the same class of randomness source used in security-sensitive applications. Nothing you generate is sent to a server; it's created and shown entirely on your device, with a live entropy readout so you can aim for the 70-bit or 100-bit mark depending on the account.

Frequently asked questions