How to make a strong password (and why length wins)

Creating a strong password in 2025 requires understanding the evolving landscape of cybersecurity threats. With cyberattacks becoming increasingly sophisticated, the passwords we create need to be more robust than ever before.

Why Password Strength Matters More Than Ever

In recent years, we have witnessed a dramatic increase in data breaches and credential stuffing attacks. Hackers now use AI-powered password cracking tools that can attempt billions of combinations per second.

The consequences of a compromised password extend far beyond a single account. Many people reuse passwords across services, meaning one breach can cascade into access to email, banking, and other critical accounts.

The Anatomy of a Strong Password

A truly strong password should incorporate several key elements. First and foremost is length — many guidelines suggest at least 16 characters for general use, though longer is often better.

• Length: At least 16 characters, preferably 20+
• Diversity: Mix of uppercase, lowercase, numbers, and symbols
• Randomness: No dictionary words, patterns, or personal information
• Uniqueness: Different password for every account

Passphrases: A Modern Approach

Passphrases consist of multiple random words from a large word list, often with separators or extra characters. Avoid famous examples or quotes—pick words randomly (for example using the EFF long wordlist) so the phrase is not predictable.

The EFF maintains a curated wordlist for creating secure passphrases. Aim for at least four to six words and add numbers or symbols between words for extra security.

Testing Your Password Strength

Use reputable password strength checkers to evaluate security. Pay attention to the entropy score — a password with 60+ bits is considered strong, while 80+ bits provides excellent protection.