How to Create a Strong Password: Examples, Rules & Tips (2026)

Many people still rely on easy-to-remember passwords that hackers can crack in seconds, despite having dozens of online accounts. This guide explains how to create a strong password using methods like the 8-4 rule and three random words, backed by the latest expert advice.

Average time to crack a 12-character random password: 226 years (Hive Systems 2025) ·
Most common password in 2025: 123456 ·
Percentage of people who reuse passwords: 65% (Google/Harris Poll) ·
Minimum characters recommended by CISA: 16 ·
Number of passwords the average person manages: more than 100

Four key recommendations from leading authorities, one pattern: each emphasizes length over complexity tricks.

What is an example of a strong password?

Examples using random characters

A strong password built from random characters mixes uppercase, lowercase, numbers, and symbols. The National Institute of Standards and Technology (NIST, U.S. cybersecurity standards body) gives this example: S&h9!mP2@qL4. That’s 12 characters with no dictionary words – the kind a password generator spits out.

Examples using the three-word rule

The UK’s National Cyber Security Centre (NCSC) promotes picking three random words and joining them: coffee-turtle-bright. This method creates a long, memorable passphrase. To strengthen it, add a special character or number: coffee-turtle-bright!.

Examples for Gmail

Google Support recommends at least 12 characters and suggests using a phrase you can remember, like MyDogLikesToRun4Miles!. That’s 24 characters, easy to recall, and mixes case, numbers, and a symbol.

The pattern: combining length with randomness or memorable phrases creates strong passwords.

What is the 8 4 rule for creating strong passwords?

Origin of the 8-4 rule

The 8-4 rule has been a common industry baseline: at least 8 characters including one uppercase, one lowercase, one number, and one symbol. But this minimum UpGuard (cybersecurity research firm) says is “typically 8 characters, but longer passwords are better.” The National Cybersecurity Alliance (nonprofit security advocacy) states passwords should be at least 16 characters.

How to apply the 8-4 rule

If you still want to use the 8-4 rule, extend it. Start with a base phrase like Chapman University (higher education IT security) suggests: “My favorite vacation was in Hawaii.” Shorten it to MfvwiH, then add complexity: MfvwH@2021. That meets the 8-4 rule but is still too short by modern standards.

The implication: The 8-4 rule is outdated as a sole strategy. Modern guidance pushes you to 12–16 characters, making the old “8 with symbols” approach insufficient.

What is the 3 word password rule?

How the three random words method works

The NCSC (UK government cybersecurity authority) champions three random words because they are easier to remember than a jumble of characters. The idea: pick three unrelated words like apple-bridge-monkey. Because they aren’t a common phrase, the passphrase is long and unpredictable.

Why three random words can be secure

Length matters more than complexity. A 15-character passphrase of three words has far more combinations than an 8-character random string. NIST confirms that a passphrase can help you create something long and memorable. The National Cybersecurity Alliance adds that strong passwords are random strings of letters, numbers, and symbols — but a passphrase of three words achieves that randomness naturally.

The implication: three-word passphrases offer a good balance of security and memorability when augmented with a symbol.

What are 10 common passwords to avoid?

Most common passwords globally

According to NordPass (password management company) 2025 list, the top 10 most common passwords are:

• 123456
• password
• 123456789
• qwerty
• 12345
• 12345678
• 111111
• 1234567
• sunshine
• qwerty123

Why these passwords are dangerous

These passwords all have short length, predictable patterns, or dictionary words. Hive Systems 2025 shows that any 8-character password can be cracked in less than an hour — these common ones take seconds. The National Cybersecurity Alliance advises avoiding recognizable words, names, keyboard patterns, or dates.

The pattern: short length + common patterns = instant compromise. Avoid any password on the top 100 lists.

How to create a strong password for Gmail?

Gmail-specific password requirements

Google Support requires at least 8 characters but recommends at least 12. For Gmail, use a unique password that you don’t reuse elsewhere. Google’s password manager can generate and store strong random passwords for you.

Using Google’s password manager

Google’s built-in password manager creates random 15-character passwords by default. You can also use a phrase like MyDogLikesToRun4Miles! – long, personal, but not guessable. The National Cybersecurity Alliance says each account should have its own password, so never reuse your Gmail password elsewhere.

The trade-off: A custom phrase is easy to remember; a generated password is more secure but requires a manager. Use the manager for Gmail if you can.

Step-by-step: How to create a strong password

1. Start with length. Aim for at least 16 characters, as recommended by NIST and National Cybersecurity Alliance.
2. Use a passphrase. Pick three random words (e.g., “sunset-bicycle-rose”) and join them with hyphens or spaces. NCSC endorses this method.
3. Add complexity. Insert a number and a symbol, like “sunset-bicycle-rose!7”. Chapman University advises using numbers, symbols, and even spaces.
4. Make it unique. Never reuse passwords across accounts. The National Cybersecurity Alliance says each account should have its own password.
5. Use a password manager. NIST recommends managers to generate and store strong passwords. Google’s manager and others can handle the heavy lifting.
6. Enable multifactor authentication. NIST says the first thing you should do is add multifactor authentication. Even a strong password benefits from a second layer.

The pattern: using a password manager and multifactor authentication provides comprehensive security.

For the average person managing more than 100 passwords, the choice is clear: use a password manager to generate and store unique, long passwords for every account, and enable two-factor authentication wherever possible. The weakest link is no longer the password itself — it’s the human habit of reusing them. Those who rely on a manager and a passphrase for their most critical accounts (like Gmail) will stay ahead of attackers in 2026.

Frequently asked questions

What this means: addressing common questions helps reinforce best practices.