How to Create a Strong Password: Google, Microsoft & NIST Tips

Most of us type our passwords dozens of times a day without really thinking about them—until something gets hacked. The problem is that what feels like a perfectly reasonable password (“P@ssw0rd123!”) often gets cracked in seconds, while genuinely strong ones take centuries to break. This guide walks you through creating passwords that actually hold up, backed by step-by-step advice from Google, Microsoft, and NIST security experts, and includes working examples you can use today.

Recommended Minimum Length: 12 characters · Required Elements: Uppercase, lowercase, numbers, symbols · Strong Password Example: Tr0ub4d0r&3 · Passphrase Option: 3 random words · Avoid Common Lists: Top 10 passwords like ‘123456’

Key specifications from major security authorities provide a clear baseline for password requirements.

What are 5 things that make a strong password?

A password’s strength comes down to five concrete factors that security authorities from Google to NIST all agree on. Length matters most—each character you add multiplies the number of possible combinations an attacker must test. Beyond length, character variety matters: mixing uppercase letters, lowercase letters, numbers, and symbols makes brute-force attacks harder.

Length requirements

Google requires passwords to be at least 12 characters long (Google Help), while Microsoft recommends 14+ characters for business accounts (Microsoft Learn), and NIST pushes the bar to 15 characters for government standards (NIST). StaySafeOnline goes even further, recommending 16 characters as the baseline for maximum security (StaySafeOnline). The pattern is clear: longer passwords are exponentially harder to crack.

Character variety

Random strings with a mix of letters, numbers, and symbols are stronger than short passwords with clever substitutions like “P@ssw0rd!” (StaySafeOnline). Microsoft provides a clear example: “tHr33b1rd$” is far stronger than “threebirds” because it combines uppercase letters, lowercase letters, numbers, and symbols in an unpredictable pattern (Microsoft 365).

Avoid dictionary words

Google explicitly prohibits passwords that are particularly weak, including common dictionary words, personally identifiable information like nicknames or pet names, and keyboard patterns like “qwerty” or sequences like “1234” (Google Help). Microsoft similarly advises against dictionary words in passwords and recommends banning easy guesses like “password” and “123456” for organizational accounts (Microsoft Learn).

The implication: length beats complexity. A 16-character random string (even if it uses only lowercase letters) takes millions of years to crack, while an 8-character complex password like “P@ssw0rd!” can fall in hours.

What is an example of a strong password?

Concrete examples help more than abstract rules. Microsoft offers “tHr33b1rd$” as a strong password example that demonstrates mixed case, numbers, and symbols in a memorable pattern (Microsoft 365). Microsoft’s Edge browser password generator suggests strong random passwords like “ZF5CnT4zne__s-r3” (Microsoft 365). Cybernews recommends customizing base passwords by adding account codes—like adding “£bay” to a base password for eBay uniqueness (Cybernews).

8-character examples

• “X#8kQ2$m” – 8 mixed characters, but borderline given modern cracking speeds
• Even strong 8-character examples face 8-character minimums in Windows domains (7 on Domain Controllers) (UCLA SEASnet guide)

Longer passphrase examples

• “correct-horse-battery-staple” – 25 characters, easier to remember
• “PurpleElephant$Swims9” – 21 characters with mixed variety
• UIC recommends 12-16 characters using passphrases for memorability (UIC IT guide)

Service-specific examples

For Gmail specifically, Google recommends passwords at least 12 characters long using lyrics, quotes, or series of meaningful words (Google Help). Note that Google does not support accented characters in passwords—stick to standard ASCII.

What this means: skip the memorable words disguised with symbol substitutions. Instead, either use a password generator or create a longer phrase you actually remember. The tradeoff is real: “Tr0ub4d0r&3” (12 chars) is harder to type manually than a passphrase, but it’s safer than a shorter complex password.

How do you generate a really strong password?

You have two reliable paths: let a tool generate a random string, or craft a passphrase using the three-word method. Both approaches produce passwords that resist modern cracking techniques.

Use password generators

Password generators create cryptographically random strings that no human would guess. Microsoft Edge’s built-in password generator activates automatically on sign-up and password-change forms, suggesting strong random passwords and saving them to your Microsoft account (Microsoft Support). LastPass offers a free online generator recommending 15-character passwords as ideal length (LastPass). Google advises using password managers to handle unique long passwords for each account (Google Help).

Manual creation steps

If you’re creating a password manually, follow this sequence: start with at least 12 random characters, then vary case, add numbers and symbols at unpredictable positions, and avoid keyboard walks or personal references. Cybernews 2026 rules specify over 10 characters with mixed case, numbers, and symbols, using generators or passphrases, and unique passwords per account (Cybernews). UCSB IT recommends using MFA alongside different passwords per account and prioritizing length over complexity (UCSB IT best practices).

Free tools

• LastPass Generator – free, no account required
• Microsoft Edge built-in – free for Edge users
• StaySafeOnline – security guidance and tool recommendations

The pattern: automated generation beats manual creation every time for random strength, but the passphrase method gives humans a viable alternative when they want to memorize without a manager.

What is the 3 word password rule?

The three-word passphrase method is NIST’s preferred approach for human-memorable passwords that still resist cracking. Instead of a complex 8-character string, you pick three random, unrelated words and combine them.

How it works

NIST recommends at least 15 characters, passphrases, password managers, and MFA or passkeys over passwords alone (NIST). A passphrase of three random words naturally hits that 15+ character threshold. UIC recommends 12-16 characters using passphrases specifically for memorability (UIC IT guide). StaySafeOnline confirms that length trumps complexity—a 16+ character passphrase is stronger than a short complex password (StaySafeOnline).

Security comparison

Three random words create a passphrase with high entropy comparable to 12+ random characters (StaySafeOnline). The math favors this approach: a 6-word keyboard pattern might be memorable but easy to guess, while three truly random words offer both memorability and strength.

Examples

• “elephant-purple-flamingo” – 24 characters, lowercase only
• “RedTiger$Swimming9” – 19 characters with symbols and numbers
• “correct-horse-battery-staple” – the classic, now a benchmark

The catch: the words must be genuinely random. “MyDog’sName2024” looks complex but relies on personal information that attackers routinely target first. Real randomness matters more than apparent complexity.

What are 5 tips to create a strong password?

Practical tips distilled from official guidance at Google, Microsoft, and NIST give you actionable steps you can apply immediately.

For Gmail

• Go to myaccount.google.com, select “Security,” then “Password”
• Use at least 12 characters—Google’s minimum (Google Help)
• Avoid personal info: Google prohibits nicknames, pet names, birthdays, or addresses in passwords (Google Help)
• Google does not support accented characters—stick to standard ASCII

Avoid top passwords

• The top 10 most common passwords (“123456”, “password”, “qwerty”) are cracked instantly in any breach dictionary
• Microsoft advises banning easy guesses like “password” and “123456” for organizational accounts (Microsoft Learn)
• Google prohibits previously used passwords (Google Help)

Manager integration

• Password managers are recommended universally by Google, Microsoft, and NIST for handling unique long passwords (Google Help)
• Microsoft Edge’s generator suggests and saves strong passwords automatically (Microsoft Support)
• Use MFA alongside strong passwords: NIST recommends MFA or passkeys over passwords alone (NIST)

Why this matters: most password breaches succeed not through sophisticated cracking but through reused passwords from other breaches. One unique strong password per account limits blast-radius damage when a service gets compromised.

“Long passwords are stronger, so make your password at least 12 characters long.”

Google Help (Official Guide)

“Maintain a 14-character minimum length requirement.”

Microsoft Learn (Official Policy)

“If you must make a password, make sure it’s at least 15 characters long.”

NIST (Cybersecurity Authority)

For everyday users, the practical choice is straightforward: use a password manager with a 15-character generated password for each account, or build three-word passphrases you can actually remember without writing them down. MFA is non-negotiable for any account that supports it—NIST makes this explicit, preferring passkeys over passwords where available. The days of memorable but weak passwords are over; the math simply doesn’t work anymore.

Related reading: Google $135M Settlement

For enhanced security beyond 12 characters, a 16-character password generator employs cryptographic randomness to produce credentials resistant to brute-force attacks.

Frequently asked questions