What makes a strong password? Length, randomness and uniqueness, per NIST SP 800-63B

What makes a strong password?

A strong password is long, randomly chosen and used on exactly one account.

Password strength is how hard a password is to guess, whether by a person who knows you or by software trying billions of combinations. Three things decide it:

1. Length. Every extra character multiplies the number of possible passwords an attacker has to try.
2. Randomness. A password you picked because it means something to you is far easier to guess than one a generator or dice picked.
3. Uniqueness. A password reused on two sites is only as safe as the weaker site. When one leaks, attackers try the same email and password everywhere else.

Notice what is missing: a capital letter, a number and a symbol. Those rules feel strong but add little when people follow them in predictable ways.

What does NIST SP 800-63B say about password strength?

NIST SP 800-63B says length and breach screening matter, and forced complexity and forced expiry do not.

NIST SP 800-63B is the US National Institute of Standards and Technology's guideline on digital identity. Its current revision sets these rules for the systems that check passwords:

• A minimum of 15 characters when the password is the only factor, and 8 characters when it is used with multi-factor authentication.
• Accept passwords of at least 64 characters, including spaces and any printable characters, so passphrases fit.
• Do not impose composition rules such as "must contain a symbol and a number".
• Check new passwords against a blocklist of commonly used, expected or already-breached passwords.
• Do not force periodic changes; require a change when there is evidence of compromise.

The last point is covered in depth in how often you should change passwords according to NIST. The short version: a long, unique password can stay until something goes wrong.

Why is length stronger than complexity?

Length is stronger because each added character multiplies the search space, while complexity rules mostly add predictable decorations.

Think about how people meet a "capital, number, symbol" rule. They take a word, capitalise the first letter, swap an a for @ and add 1! at the end. Password-cracking tools know these habits and try them first, so the result looks complex but sits near the front of the queue.

Now compare the arithmetic for truly random choices:

Each bit doubles the guesses needed. These figures only hold when the choice is genuinely random; a phrase you invented, a song lyric or a famous quote is much weaker than its length suggests.

What do strong and weak password patterns look like?

Strong patterns are long and random; weak ones are short, personal or built from a common habit.

The examples below show the shape of each pattern. They are illustrations only: never use a password you have seen printed anywhere, because published examples end up on attackers' lists.

How to create secure passwords you never have to remember

The easiest way to create secure passwords is to let a password generator make them and a password manager store them.

A generator picks every character at random, which humans are bad at. Most password managers include one; aim for 16 to 20 characters or more wherever the site allows it. Because the manager remembers and fills the password, length costs you nothing.

1. Install a password manager and set one strong master password (see the passphrase steps below).
2. On every sign-up form, use the generator instead of typing your own.
3. For existing accounts, change the most important ones first: email, banking, work accounts and anything that can reset other passwords.
4. Turn on two-factor authentication on those same accounts.
5. Run a breach check and replace any password that shows up as exposed or reused.

If your team shares accounts, the same rules apply to every shared login. Our guide to stopping password reuse in a team covers how to find and clean up the repeats.

How do you make a strong passphrase?

A strong passphrase is four to six or more words chosen at random, not a sentence you made up.

Passphrases are the right tool for the few passwords you must type from memory: your password manager's master password, your computer login and perhaps your main email. Here is the method:

1. Get a published word list made for this, such as the EFF long word list (7,776 words).
2. Roll five ordinary dice for each word and look up the number, or use a generator that picks words randomly.
3. Pick at least six words for a master password; never swap in words you like better.
4. Join them with spaces or hyphens. Adding capitals or a digit is fine but optional.
5. Write it down once and store the note somewhere physically safe until you know it by heart.

The randomness is what makes it strong. "I love my dog Max" is long but predictable; six dice-picked words are not.

Is a strong password enough on its own?

No, a strong password protects against guessing but not against phishing, malware or a site that leaks it.

If you type a perfect password into a fake login page, the attacker has it. That is why important accounts also need a second factor. Read what two-factor authentication is for the options, from authenticator apps to passkeys.

Also watch for breaches. Services like Have I Been Pwned let you check whether a password has appeared in a known leak without sending the password itself. If it has, change it everywhere it was used.

How does BobWork Vault help you use strong passwords?

BobWork Vault generates, stores and fills strong passwords so you do not have to remember them.

BobWork Vault is a free password manager with a Chrome extension (also Edge, Brave and Arc) and a web vault that works in any modern browser. On sign-up forms it offers a 20-character generated password, saves new logins after you sign in, and fills them with one click from the key icon in the login field.

Password health checks use Have I Been Pwned's k-anonymity method, so only the first 5 characters of a SHA-1 hash leave your browser. Everything is encrypted in the browser with AES-256-GCM before it reaches the server, and teams can share logins on the free plan. Create a free BobWork Vault account and replace your weakest passwords first.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• How often should you change passwords? What NIST SP 800-63B actually says
• How to get employees using unique passwords (and stop password reuse)
• What Is a 2FA? Two-Factor Authentication Explained for Business Accounts
• Sample password policy for small business: a short, modern template you can copy today

More: free password manager · free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers