Strong Password
A strong password is one that's difficult for both people and computers to guess.
The most important factors are length and uniqueness — a longer password is much harder to crack, and using a different password for every account prevents one breach from compromising everything. A good approach is to use a passphrase of random words or let a password manager generate one for you.
Strong Password, explained at three levels
At home
A strong password is long, unique, and not something anyone could easily guess. Instead of using your pet's name or birthday, try stringing together several random words like 'purple-bicycle-cloud-tennis.' The longer the password, the harder it is for a hacker's computer to crack. Most importantly, use a different password for every account.
At work
In the workplace, strong password policies help protect company systems and data. Modern best practices focus on password length over complexity, encouraging passphrases rather than short passwords with special characters. Organizations pair strong passwords with two-factor authentication and single sign-on to balance security with usability.
At home
Password strength is measured by entropy — the randomness and unpredictability of the password. A 20-character passphrase of random words is generally stronger than an 8-character password with special characters, because length dramatically increases the number of possible combinations an attacker would need to try.
At work
At a professional level, password policy design balances security with usability. NIST guidelines recommend minimum lengths of at least 12 characters, screening against known compromised passwords, and eliminating forced periodic rotation. Modern policies also integrate with password managers and support passphrases to encourage longer credentials.
At home
Advanced users understand that password cracking tools use dictionaries, common patterns, and leaked password databases to speed up attacks. They use password managers to generate truly random strings of 20 or more characters and enable two-factor authentication as a backup in case any password is compromised.
At work
Enterprise password strategy involves implementing password policies that align with frameworks like NIST SP 800-63B, deploying credential screening against known breach databases, and integrating with identity providers that support passwordless authentication. Organizations are increasingly moving toward passkeys and FIDO2 standards to reduce reliance on passwords altogether.
Real-world examples
At home
Hannah used to use her dog's name followed by '123' for most of her accounts. After learning about password strength, she started using a password manager to generate random 20-character passwords for each account, making her online life significantly more secure.
At work
Alex, an IT security lead at a manufacturing company, updated the organization's password policy to require 14-character minimums and screen new passwords against a database of known breached passwords. He also removed the mandatory 90-day rotation rule after research showed it led to weaker password choices.
Common confusions
- It's a common myth that replacing letters with numbers like 'p@ssw0rd' makes a password strong. Attackers know these common substitutions and account for them.
- One common misunderstanding is that short passwords with special characters are strong. A long passphrase of plain words is typically much harder to crack.
- It's easy to assume changing passwords frequently improves security. Forced rotation often leads people to choose weaker, more predictable passwords.
For analysts
Business analysts should define password requirements in system specifications that align with current best practices. This means specifying minimum length rather than complex character requirements, integrating with breach databases to screen passwords, and supporting password managers through proper form design. Good password policy in requirements protects the organization without frustrating users.
History & origin
Early computers had minimal password requirements, and many systems shipped with default passwords like 'admin.' As computing power increased, brute-force attacks made short passwords easy to crack. Security guidance has evolved from complex character requirements toward emphasizing length and uniqueness as the most effective measures.