Strong password examples
What a strong password actually looks like, why common "strong-looking" ones fail, and how to make your own in under a minute.
Three fresh strong passwords, made for you
Generating in your browser…
Two diceware passphrases and one random string, created with crypto.getRandomValues. Reload for new ones, or tune them in the password generator and passphrase generator.
Weak passwords and stronger replacements
| Looks OK, isn't | Why it fails | Stronger shape | Example of that shape |
|---|---|---|---|
password123 | Top of every leaked-password list | Random 16 characters | rV7#qLm2!xT9wz$K |
Summer2024! | Season + year + ! is a standard cracking rule | Five random words | tulip-anvil-scorch-humid-ferry |
P@ssw0rd | Letter-for-symbol swaps are undone instantly | Six random words | gravy mosaic unbent pelican stool ranger |
qwertyuiop | A keyboard row | Random 20, no look-alikes | mZ4tq8XhbN3wRk7eWp2c |
Fluffy2012 | Pet name + year, easy to find on social media | Passphrase + digit | cider-7-oblong-wafer-trunk-avid |
iloveyou | Common phrase, in every dictionary | Random 4 words for low-risk logins | rumble.sprout.decoy.plaza |
Paste any of the weak ones into the strength checker to see which patterns give them away.
What makes a password strong
- It's long. NIST SP 800-63B recommends at least 15 characters when a password is the only thing protecting an account. Five random words easily clears that.
- It's random. Chosen by dice or a secure generator, not by you. People are predictable: we capitalise the first letter, put numbers at the end, and pick words that mean something.
- It's unique. Reuse is how one breach becomes ten. Attackers take leaked email-password pairs and try them everywhere ("credential stuffing").
- It's not in a breach list. Run it through the breach check, which never sends the password itself.
How to create a strong password
- Install a password manager (the one built into your phone or browser is fine to start).
- For the few passwords you must remember (the manager itself, your computer, your main email), generate a passphrase of 6 random words.
- For every other account, let the manager or our generator create a random 16–20 character password.
- Turn on multi-factor authentication for email, banking and anything that can reset other accounts.
Strong password FAQ
What is an example of a strong password?
A strong password is long and random. Two good shapes are a 16+ character random string such as the ones our generator produces, or a passphrase of five or more randomly chosen words such as "plank-velvet-harbor-quietly-mango". Never copy an example you saw published online, including ours: published passwords end up in cracking lists.
What makes a password strong?
Length, randomness and uniqueness. It should be long enough (15+ characters, or 5+ random words), chosen by a random process rather than your imagination, and used on only one site. Symbols and capitals matter far less than people think.
How do I create a strong password I can remember?
Use a diceware passphrase: several words picked at random from a large list. It is easier to remember than a jumble of symbols and just as strong. Save everything else in a password manager so you only need to remember one or two passphrases.
Is a sentence like "IloveMydog2015!" strong?
No. Personal facts, common phrases, capital-first-letter and a year plus ! at the end are exactly what cracking rules try. The words must be random, not meaningful to you.
Should I change my password regularly?
Only when there is a reason, such as a breach or suspected compromise. NIST SP 800-63B says services should not force periodic changes, because users respond with predictable tweaks (Spring2025! to Summer2025!) that make passwords weaker.