How to generate a strong password (and why length beats complexity)

For years we were told a "strong" password meant P@ssw0rd! — a jumble of upper, lower, numbers and symbols. That advice was mostly wrong. The maths of password cracking says something simpler and more powerful: length beats complexity. Here's why, and how to generate passwords that actually hold up.

Strength is measured in entropy

Password strength comes down to entropy — the number of possible passwords an attacker would have to try. More entropy means more guesses, which means more time and money to crack. Two things drive it:

• The size of the character set you draw from (lowercase = 26, add uppercase = 52, add digits = 62, add symbols ≈ 95).
• The length of the password.

The formula is: possibilities = (character-set size) raised to the power of (length). Here's the key insight: length is an exponent, and character-set size is only the base. Growing the exponent overwhelms growing the base every single time.

Why length wins, with numbers

• An 8-character password using all 95 printable characters has about 95^8 ≈ 6.6 quadrillion combinations. Sounds like a lot — but modern hardware guesses billions per second, so it falls in hours.
• A 16-character password using only lowercase letters has 26^16 ≈ 43 sextillion combinations — roughly six million times more than the "complex" 8-character one, despite using a smaller character set.

Doubling the length does far more than adding symbols ever could. This is why every serious guideline (including NIST's) now emphasises length and de-emphasises forced complexity rules.

The passphrase: strong and memorable

You don't have to choose between strength and memorability. A passphrase — several random words strung together — gets its strength from length while staying easy to recall:

correct-horse-battery-staple
violet-anchor-tunnel-marble-77

Four or five *randomly chosen* words give enormous entropy. The catch is "randomly chosen" — a famous quote or song lyric is not random and will be in attackers' wordlists. Pick words with dice or a generator, not from memory.

Why NIST dropped the old rules

Modern guidance actively discourages the old advice because it backfired:

• Forced complexity (must have a symbol, a number, a capital) pushed people toward predictable patterns like Password1! — easy for humans to remember and easy for crackers to guess.
• Forced periodic changes (every 90 days) led to weaker passwords like Spring2026! → Summer2026!. NIST now recommends changing passwords only when there's evidence of compromise.
• Length minimums went up and complexity requirements came down.

The rules that actually matter

1. Make it long — at least 16 characters for anything important; longer for high-value accounts.
2. Make it random — generated, not invented. Human-chosen passwords cluster around patterns.
3. Make it unique per site — reuse is the number-one cause of account takeovers. One breached site shouldn't unlock the rest.
4. Never reuse across accounts — credential-stuffing attacks replay leaked passwords everywhere.

You can't remember dozens of these — use a manager

The honest conclusion of "long, random, unique per site" is that you cannot memorise them all. That's fine — you're not supposed to. A password manager generates and stores them, so you remember exactly one strong master passphrase and it handles the rest. Pair it with two-factor authentication on important accounts and you've closed the biggest gaps.

For servers: keys over passwords

On a server, the strongest password is often no password at all. SSH key authentication replaces a guessable password with a cryptographic key pair that can't be brute-forced in practice. Generate a key, copy the public half to your VPS, and disable password login entirely — the single biggest security upgrade you can make to a server.

Generate one now — safely

Our free password generator at /tools/password-generator creates strong, random passwords and passphrases entirely in your browser — nothing is sent to a server — with controls for length, character sets and word count. Use it to create a unique password per account, or a memorable high-entropy passphrase for your password manager's master key.

And when you spin up a Nxeon VPS, skip passwords for SSH altogether: add your public key at deploy time so the server comes up key-only from the first second. See /vps.