Passphrase Lab

Guide

How to create a strong password

Updated 30 October 2026

Summary. Make it long, make it random, and use it on one site only. The longest current advice we read is at least 15 characters, and several official bodies now suggest random words, because they are long and easier to remember.

1How long should a password be?

Table 1. What official bodies advise, read 30 October 2026
CountryBodyAdvice
United StatesNISTAt least 15 characters for a password used alone, and at least 8 with a second login step. Sites must not impose other composition rules [1]
United KingdomNCSCThree random words [2]
CanadaGet Cyber SafeFour or more random words and at least 15 characters. For a traditional password, at least 12 characters with mixed types [3]
AustraliaASD's ACSCAt least 15 characters, such as a random mix of unrelated words [4]
New ZealandOwn Your OnlineFour or more random words [5]
IndiaCERT-InAt least 8 characters, in an advisory for organisations [6]

They differ, so our report grades against the strictest common figure: under 8 characters is a Fail, and under 15 is a Check. How the check works

2What guessing tools try first

Attackers do not start at "aaaa". They start with what people really choose. Our report looks for the same things, using the zxcvbn library:

  • Common passwords, such as those already in breach lists.
  • Names, places and words, with letters swapped for symbols (p@ssw0rd).
  • Years and dates, often a birthday.
  • Keyboard runs (qwerty, 1qaz) and repeats.

ASD's ACSC also warns against "anything about you that's publicly available" [4].

Check a password for these

3How to make one

  1. Use random words, or a random string from a generator. Words you pick yourself are less random than they feel, so let a generator choose.
  2. Make each one unique. ASD's ACSC: "Use a unique password for every account" [4]. CERT-In says the same for social media and email [7].
  3. Keep them somewhere. The UK's NCSC accepts writing a password down if you keep it somewhere safe, or using a password manager [2].
Make a passphraseCompare password managers

4Do I need to change it regularly?

Official advice differs here. NIST says sites must not require regular changes, and must force a change when there is evidence of compromise [1]. CERT-In's booklet says to change passwords frequently [7]. We follow NIST and ASD's ACSC: change a password when you have a reason to think it has leaked. If your employer has a rule, follow it.

Sources

  1. [1]NIST, SP 800-63B-4, section 3.1.1 (United States). Read the source. Read 30 October 2026.
  2. [2]National Cyber Security Centre, Three random words, published 21 December 2021 (United Kingdom). Read the source. Read 30 October 2026.
  3. [3]Get Cyber Safe, Passphrases, passwords and PINs (Canada). Read the source. Read 30 October 2026.
  4. [4]ASD's ACSC, Personal cyber security handbook, published 7 October 2026 (Australia). Read the source. Read 30 October 2026.
  5. [5]Own Your Online, Create good passwords (New Zealand). Read the source. Read 30 October 2026.
  6. [6]CERT-In, Advisory CIAD-2022-0026, Password Management and Security, issued 18 October 2022 (India). Read the source. Read 30 October 2026.
  7. [7]CERT-In and Cyber Swachhta Kendra, Internet Safety Awareness Booklet for Digital Nagriks and Digital Enterprises, Safer Internet Day 2024 (India). Read the source. Read 30 October 2026.