Around twenty-seven thousand people a month type strong password example into Google. Almost all of them want the same thing: a ready-made password sitting on a page, good enough to copy into the box that just rejected their last three attempts.
This article will not give you one. Not because it is being difficult, but because the moment a password is published on a public page it stops being a password. That is not a technicality. It is the whole reason the request cannot be answered the way it is asked.
What can be answered is the question underneath it — what makes a password strong, why the rules most websites enforce actively make things worse, and what to copy instead of the characters.
What the Search Is Really Asking
Search around the main term and the pattern is obvious. People look for strong password ideas, strong password suggestions, examples with exactly 8 characters, examples for Gmail, examples that are easy to remember. Someone even searches for the strongest password in the world, which is a lovely question with a slightly disappointing answer: it is whichever one nobody has ever written down anywhere, including here.
Underneath all of it is one practical problem. A site demanded an uppercase letter, a number and a symbol, the obvious attempts were rejected, and now the user needs something that will pass. The search is not really about security at all. It is about getting through a form.
That is worth naming, because it explains why so much password advice fails. It optimises for satisfying a validation rule rather than for surviving an attack, and those two goals point in different directions more often than you would expect.
Every Published Example Is Already Burned
Password cracking does not start with brute force. It starts with a list.
Attackers keep enormous wordlists — leaked passwords from previous breaches, dictionary words in dozens of languages, song lyrics, film titles, sports teams, and text scraped from the public web. The famous rockyou.txt list alone carries over fourteen million real passwords taken from a single 2009 breach, and it is the starting point, not the ceiling.
Anything printed on a page that ranks for strong password examples lands in those lists quickly, for the simple reason that the people building wordlists also know how to use a search engine. A password published as an example is tried in the first few seconds of an attack, not the last.
The same applies to anything a friend suggests, anything in a listicle, and anything an AI assistant hands you in a chat window that later becomes training data. If you did not generate it yourself, treat it as public.
Why P@ssw0rd123! Is Weaker Than It Looks
Look at what a typical strong password looks like after a human has satisfied a composition rule: P@ssw0rd123!
Twelve characters. Upper case, lower case, digits, a symbol. It passes almost every validation rule on the web, and a lot of strength meters will colour it green. It is also close to worthless, and the reason is that every decision in it is one a million other people made too.
Cracking tools do not guess character by character. They take a wordlist and apply rules — small transformations that mimic exactly what people do when a form demands more complexity. The common ones are not a secret; they are shipped as standard rule files with the tools.
| What people do | Example | How much it helps |
|---|---|---|
| Capitalise the first letter | password → Password | Almost nothing — it is rule one |
| a → @, o → 0, i → 1, e → 3 | Password → P@ssw0rd | Almost nothing — standard substitution set |
| Add digits at the end | P@ssw0rd → P@ssw0rd123 | Very little — years and 1–4 digit runs are tried first |
Add ! at the end | P@ssw0rd123 → P@ssw0rd123! | Very little — the most common final symbol by a wide margin |
| Pick a longer random string | — | Everything. This is the only column that matters |
The uncomfortable part is that the complexity rules caused this. Told to add a capital, people capitalise the first letter. Told to add a number, they append the current year. Told to add a symbol, they reach for !. The rule did not add unpredictability; it added a predictable step, and predictable steps are cheap to automate.
Password Strength Has a Unit
“Strong” sounds subjective, but it is measurable. The unit is bits of entropy, and it answers one question: how many different passwords could this process have produced, given that the attacker knows the process?
For something generated at random, the formula is short:
entropy in bits = length × log₂(size of the character pool)Pick from 26 lowercase letters and each character is worth log₂(26) ≈ 4.7 bits. Pick from all 94 printable ASCII characters and each is worth about 6.55 bits. Every extra bit doubles the number of possibilities.
This is why a strength meter can only ever be an estimate. A good one looks for dictionary words, keyboard walks such as qwerty, dates, repeated characters and known substitutions, and marks the password down when it finds them. That is roughly what the “no common patterns” style of feedback on a generator is reporting.
Length Beats Complexity, and It Is Not Close
Here is the same idea as numbers. Every row below assumes genuinely random selection, and the crack times assume a fast, badly chosen hash — the situation after a database breach, not someone typing guesses into a login form.
| Password | Entropy | Offline guessing at 10¹¹/sec |
|---|---|---|
| Human-chosen, “complex”, 12 chars | ~28 bits | Under a hundredth of a second |
| 8 random lowercase letters | 37.6 bits | About 1 second |
| 8 random printable characters | 52.4 bits | About 8 hours |
| 4 random words from a 7,776-word list | 51.7 bits | About 5 hours |
| 5 random words | 64.6 bits | About 4 years |
| 6 random words | 77.5 bits | Around 34,000 years |
| 12 random printable characters | 78.7 bits | Around 78,000 years |
Two things fall out of that table. The first is that strong password length does more work than the character mix: four random words, made only of lowercase letters, are worth about the same as eight random characters drawn from every symbol on the keyboard — and they are far easier to type and to remember. The second is how cheaply length buys strength. Going from eight random characters to twelve moves the answer from eight hours to seventy-eight thousand years, and one extra word takes a passphrase from four years to thirty-four thousand. Adding more symbol types to a short password does nothing remotely comparable.
That is the honest answer to how many characters a strong password needs. There is no magic number, because it depends on the pool you are drawing from. Sixteen characters of real randomness is comfortable for anything; twelve is fine for accounts protected by a decent hash and rate limiting; eight is the floor, and only just.
The Rules Most Sites Enforce Were Withdrawn in 2017
If forced complexity is counterproductive, why does every signup form still demand it?
Inertia, mostly. The rules trace back to guidance the US National Institute of Standards and Technology published in 2003, whose author later said publicly that he regretted it. NIST replaced that advice in 2017 with Special Publication 800-63B, and the current guidance keeps the same position. Two of its recommendations are the opposite of what most forms still do:
- Do not impose composition rules. Requiring a mix of character types is not recommended, because of everything in the section above.
- Do not force periodic changes. Rotating passwords every 90 days pushes people towards
Summer2026!becomingAutumn2026!. Change a password when there is a reason to believe it is exposed, not on a calendar.
What it recommends instead is worth knowing, because it tells you what a good strong password policy looks like from the other side of the form: allow long passwords, allow every character including spaces, do not truncate, do not use security questions, and check new passwords against lists of ones already known to be breached.
Copy the Method, Not the Password
There are exactly two ways to end up with a password worth having, and neither of them involves reading one off a screen.
1. Let a generator do it
For anything you do not have to type from memory — which, once you use a password manager, is nearly every account you own — random beats clever every time. A generator draws each character independently, so the entropy formula actually applies, and the result carries no pattern for a rule-based attack to exploit.
This is where the numbers stop being theoretical. Set a generator to 32 characters over a pool of 88 and the arithmetic gives 32 × log₂(88) ≈ 206.7 bits — a figure with no physical meaning other than “this will not be guessed”. The Password Generator reports that entropy figure alongside each password, which is a more useful thing to look at than a coloured bar.
2. Roll dice for a passphrase
For the handful of passwords you must actually remember — your device login, and the master password for your password manager — a passphrase is the better tool. The method is old and boringly effective:
- Take a numbered word list of 7,776 entries, the size used by the Diceware scheme.
- Roll five dice, or use a generator, to pick a word. Repeat six times.
- Join the words with spaces or hyphens. Do not edit them into a sentence that makes sense — the nonsense is the point.
Six words is 77.5 bits, memorable after a handful of repetitions, and fast to type. That is the real answer for people searching for a strong password that is easy to remember: not a clever mnemonic built from a sentence you like, which reintroduces exactly the bias the dice were there to remove, but genuinely random words that your memory happens to be very good at holding.
The Mistake That Beats Every Password
All of the above is wasted effort if the password is used twice.
When a site is breached, the stolen credentials do not stay with that site. They get replayed automatically against banks, email providers, retailers and social networks — an attack called credential stuffing. It does not need to crack anything. It needs you to have used the same password somewhere else.
This is why email accounts deserve the most care. An email inbox is not just another account; it is the reset mechanism for all the others. Whoever controls it controls everything that can send a reset link to it, which is the reason a search for a strong password for Gmail deserves a more serious answer than a search for one for a forum you joined once.
The practical order, if you only fix three things this week: unique password on your email, unique password on your bank, and two-factor authentication switched on for both. Unique matters more than strong. A mediocre password used once is safer than an excellent password used everywhere.
What a Strong Password Actually Needs
Stripped of the folklore, the characteristics of a strong password come down to four things, in order of how much they matter:
- Unique. Used for exactly one account. Nothing else on this list survives failing this one.
- Long. Sixteen or more random characters, or six random words. Length is the cheapest strength you can buy.
- Randomly generated. By a machine or by dice — not by you, because human randomness is not random and every attacker knows the shape of it.
- Never published. Not in a chat, not in a shared document, not in an example on a web page.
Notice what is missing. There is no requirement for a symbol, no requirement for a capital letter, no requirement to change it every quarter. Those rules are what a form asks for. They are not what an attacker is stopped by.
So the honest version of the answer that twenty-seven thousand people a month are looking for is this: there is no strong password example worth copying, and the ones you find are the weakest passwords on the internet precisely because they are findable. Generate your own, make it long, use it once, and never let it appear anywhere that can be read.