Strong Password Examples: What a Good Password Looks Like in 2026

5 November 2026 · 15 min read · AI Guides

Introduction

Everyone has seen the advice to use a strong password, and almost everyone is unsure what one actually looks like. Is it a jumble of symbols? A sentence? Three random words? The confusion is understandable, because the advice changed: the rules that produced passwords like P@ssw0rd1 are out, and length, randomness, and uniqueness are in.

This guide shows strong password examples in the sense that matters: patterns you can recognise and generate for yourself, not passwords to copy. Any example published anywhere, including here, is unsafe to use literally, because attackers add published examples to their guessing lists. What you need is the pattern, the reasons behind it, and a way to generate your own version in seconds with our free Strong Password Generator.

First, the warning about examples

Do not use any example password from this article, or from any article, as your own password. Attackers maintain wordlists built from leaked passwords, published examples, song lyrics, quotes, and common phrases, and they try those first. A password that appears on a public page is, by definition, already in the guessing list. The examples below are therefore shown in a form that teaches the shape while being unsafe to copy directly: they illustrate length, randomness, and structure, and the point of each one is to show you what to generate for yourself, never to hand you a password to reuse.

The same warning applies to personal passwords you invent by a pattern. A password built from your pet's name plus a birth year, your favourite team plus a number, or a keyboard walk like qwerty123, is guessable by anyone who knows a little about you or who tries common patterns. Strong means unpredictable to someone who does not know you, and also unpredictable to software that tries millions of common combinations. Randomness, not cleverness, is what provides that.

What makes a password strong in 2026

Three properties matter, in this order. Length first: every extra character multiplies the guessing space, so a 16 character password is vastly harder to brute force than an 8 character one, even if the longer one uses only lowercase letters. Randomness second: the characters or words must not be predictable from you, from language patterns, or from common substitutions. Uniqueness third: the password must be used for one account only, so that a breach at one site does not unlock the rest. A long, random, unique password is strong; a short, clever, reused one is not, however impressive it looks.

Current official guidance agrees on this shape. The US National Institute of Standards and Technology, in its Digital Identity Guidelines, now requires verifiers to accept passwords of at least 64 characters, to allow all printable characters and spaces, and not to impose arbitrary composition rules or forced periodic changes. The NIST Digital Identity Guidelines SP 800-63B set out those requirements in full. The UK National Cyber Security Centre recommends a different memorable route to the same goal, three random words, and its guidance on securing your accounts explains why uniqueness and two-step verification matter alongside length. Both bodies agree: length beats complexity, and forced symbol mixes do more harm than good.

Example pattern one: three or four random words

A passphrase of three random words, for example a colour, an animal, and an object chosen with no connection to each other or to you, is typically 15 to 20 characters long, memorable, and hard to guess, because the attacker must guess the combination, not just the words. Four random words are stronger still, at roughly 50 bits of entropy from a large wordlist, and are the right choice for a password manager master password or an email account. The words must be random: words from a sentence you like, a lyric, a quote, or a phrase about your life are not random, because attackers try those patterns first. Let a generator pick them, or pick them by opening a dictionary at random pages, not by thinking of words that feel random, which they rarely are.

Capitalisation and separators are optional extras, not requirements. Joining words with hyphens, capitalising each word, or adding a digit at the end can satisfy a site that still demands a number or symbol, and it adds a little strength, but it does not rescue words that are not random. A passphrase built from three words about your hobbies is weak however it is capitalised. Conversely, three genuinely random words with no symbols at all are strong, and a site that rejects them for lacking a symbol is enforcing an outdated rule, not a security improvement. If a site insists, add a symbol in the middle, not a predictable one at the end.

Example pattern two: a generated random password

A generated password is a random string from a chosen character set, for example 16 to 20 characters drawn from uppercase, lowercase, digits, and symbols. It has no meaning, no pattern, and no connection to you, which is exactly the point. An example shape, shown only to illustrate length and mix, would be a 16 character string with upper and lower case letters, digits, and two symbols scattered through it, not clustered at the end. Do not copy any such string from this page; generate your own with our Strong Password Generator, which creates it in your browser and never sends it anywhere, and store it in a password manager, because nobody is expected to memorise a random 20 character string for every account.

Length guidance for generated passwords: 16 characters is a sensible default for most accounts, 20 or more for email, banking, and your password manager itself, and 12 characters only where a site imposes a short maximum, which is itself a warning sign about that site. The generator on this site lets you choose length and character sets, and shows an entropy estimate, so you can see the effect of length directly: adding four characters to a 12 character password multiplies its guessing space by far more than adding a symbol to an 8 character one. When in doubt, go longer, not more complex.

Example pattern three: a sentence passphrase

A sentence passphrase is a short sentence you invent that is personal but not guessable, for example a sentence about an imaginary scene, with spaces, that only you would think of, and that is not a quote, lyric, or proverb. The strength comes from length, often 25 characters or more including spaces, and from the fact that the sentence is not in any published list. The weakness is that humans are bad at inventing sentences that are truly unpredictable: we reuse sentence structures, common verbs, and familiar imagery, and attackers' dictionaries include common sentence patterns. A sentence passphrase is better than a single word with symbols, and worse than random words or a generated string, and it is a reasonable choice for the handful of passwords you must memorise, if it is long and genuinely your own invention.

If you use a sentence passphrase, keep it unique to one account, never reuse it with a small change, and do not base it on facts about you that appear on social media. A sentence about your first car, your school, or your holiday destination is guessable by profiling. A sentence about an invented scene, a purple elephant learning to swim, for example, is not about you at all, which is why it works, but even that example, published here, must not be used literally. Invent your own scene, write it down only in your password manager, and treat the published version as a shape, not a password.

Weak patterns, shown so you can recognise them

The weakest passwords are still the commonest, and recognising them is the fastest way to improve. Single dictionary words, names, dates, and years are trivial. A dictionary word with a digit at the end, a capital letter at the start, and a symbol at the end, the classic P@ssw0rd1 shape, is barely stronger, because those substitutions are the first ones attackers try. Keyboard walks, qwerty, 123456, asdfgh, and repeated characters, aaaa1111, are in every guessing list. Short passwords of any kind, under 12 characters, are weak in 2026 regardless of symbols, because brute force has become cheap. And any password reused across sites is weak for all of them, because breaches are routine and credential stuffing, trying a leaked password on many sites, is automated.

Personal details deserve a special warning. Attackers who target a person, rather than spraying guesses, start with social media: pet names, children's names, birthdays, anniversaries, teams, schools, and employers. A password built from any of those is guessable in a handful of tries by someone who knows you, and in a dictionary attack by software that includes common names and years. The NCSC rule is simple: if somebody who knows you well could guess it in 20 attempts, it is not strong. Random words and generated strings pass that test; personal details fail it by design.

How to generate and store strong passwords properly

The practical system is: a password manager for everything, one strong master passphrase for the manager, and a unique generated password for every other account. The manager generates, stores, and fills passwords, so you only memorise the master passphrase, which should be four random words or a long sentence, plus two-factor authentication on the manager itself and on your email. This system solves the scale problem that three random words alone cannot: you cannot memorise 100 different strong passwords, and you should not try. Trying leads to reuse, which is worse than any single weak password.

When you create a new account, generate a fresh password at 16 characters or more, save it in the manager before submitting the form, and turn on two-factor authentication immediately, preferably with an authenticator app or a security key rather than SMS where the site offers a choice. When you change a password, change it because of a breach, a suspicion, or a site's advice, not on a fixed schedule: forced periodic changes lead people to make small, predictable changes to the old password, which attackers anticipate. And check whether a password has appeared in a known breach, using a reputable breach checking service, whenever you hear of a breach at a service you use; a breached password must be changed everywhere it was reused, which is why uniqueness matters more than any single password's strength.

Two-factor authentication: the second layer that matters most

Even a strong, unique password can be stolen by phishing, malware, or a site breach, which is why a second factor matters as much as the password itself. An authenticator app code, a hardware security key, or a passkey means that a stolen password alone is not enough to sign in. Turn it on first for email, because email resets most other accounts, then for banking, cloud storage, and social media. Passkeys, where offered, go further by replacing the password with a cryptographic key pair tied to your device, removing phishing and guessing entirely for that account. A strong password plus a second factor is the standard to aim for, not a strong password alone.

Passkeys: when you do not need a password at all

Passkeys are the newest alternative to passwords, and they are worth understanding because they remove the guessing problem entirely. A passkey is a cryptographic key pair: the private key stays on your device, protected by your fingerprint, face, or device PIN, and the public key sits with the service. Signing in proves you hold the private key without ever sending a secret that could be phished, guessed, or leaked from a server, because there is no password to leak. Where a service offers passkeys, using one is stronger than any password, however long, and it also removes the memorisation problem that makes people reuse passwords.

Passkeys do not replace passwords everywhere yet, and they come with their own responsibilities: you need a way to recover access if you lose your device, usually through a synced keychain or a second registered device, and you should still keep a strong, unique password and a second factor on the accounts that guard your passkeys, above all your email and your device account. The practical rule for 2026 is simple: use a passkey where it is offered, keep strong unique passwords everywhere else, and treat your email account as the master key to everything else, protecting it with the strongest combination you have.

Frequently asked questions

The Bottom Line

A strong password is not a clever string you invent, it is a long, random, unique one you generate, from random words you can remember or a random string your manager remembers for you. Learn the pattern from the examples here, generate your own version, never reuse it, and back it with a second factor. That combination, not any single example, is what keeps an account safe.