How to Create a Strong Password: The 2024 Expert Guide
The State of Password Security in 2024
Every year, security researchers at NordPass compile a list of the most commonly used passwords from data breach databases. And every year, the results are depressing. "123456," "password," "qwerty," and "iloveyou" consistently top the list — some of them crackable by modern hardware in under one second.
The consequences of a compromised account are increasingly severe: identity theft, financial fraud, blackmail from compromised private photos, and professional damage from exposed work accounts. Understanding what makes a password strong is no longer optional — it's a fundamental digital literacy skill.
How Attackers Break Passwords
Before building defences, it helps to understand attacks:
1. Dictionary Attacks
Attackers run through massive lists of common words, phrases, and known passwords from previous breaches. If your password is any word that appears in a dictionary, or any common variation (like "P@ssw0rd"), it will be found in seconds.
2. Credential Stuffing
When a website's database is breached, the stolen username/password pairs are tested automatically against hundreds of other popular services. If you reuse passwords, one breach cascades into many. The Have I Been Pwned database currently contains over 12 billion compromised credential pairs.
3. Brute Force
Modern GPUs can test billions of password guesses per second. A 6-character password using only lowercase letters has just 308,915,776 combinations — crackable in under a second. An 8-character mixed-case password has about 200 trillion combinations — crackable in minutes to hours depending on hashing algorithm. A 12-character random password is effectively uncrackable with current hardware.
4. Phishing
The most common attack doesn't try to guess your password at all — it tricks you into typing it into a fake login page. No amount of password strength protects against phishing, which is why multi-factor authentication (MFA) is essential.
What Makes a Password Genuinely Strong?
A strong password needs three properties simultaneously:
- Length — This is the single most important factor. Each additional character exponentially increases the number of possible combinations.
- Randomness — A predictable pattern (replacing 'a' with '@', adding '123' at the end) is trivially tested by modern cracking tools. True randomness — generated by a machine, not a human brain — is essential.
- Uniqueness — Every account must have its own unique password. This is non-negotiable. A single reused password means every site you use is only as secure as the weakest site.
Password Length: The Numbers
| Length | Characters Used | Combinations | Crack Time (modern GPU) |
|---|---|---|---|
| 8 chars | Lowercase only | 208 billion | 5 minutes |
| 8 chars | Mixed case + numbers | 218 trillion | 1 hour |
| 12 chars | All character types | 475 quintillion | 34,000 years |
| 16 chars | All character types | Astronomical | Heat death of the universe |
| 4 random words | Large word list | Very high | Millions of years |
Two Approaches to Strong Passwords
Approach 1: Machine-Generated Random Passwords (Recommended)
A random string like Bv$7nWp!3qR@mLkZ is mathematically impossible to guess and nearly impossible to crack with current hardware. The obvious downside is that it's also impossible for humans to memorize.
The solution: use a password manager to store these passwords. You only need to memorize one strong master password, and the manager handles the rest.
Generate one now: Flixfer's free Password Generator uses your browser's cryptographically secure random number generator — the same technology used in banking applications.
Approach 2: Passphrases (Good for Memorizable Passwords)
For passwords you must memorize (your password manager's master password, your computer login), passphrases are superior to random strings. Take four or more random words: "correct-horse-battery-staple." This is long, memorable, and mathematically extremely secure. The key is that the words must be genuinely random — not a famous quote or a meaningful phrase.
The Non-Negotiables: MFA and a Password Manager
A strong password alone is insufficient in 2024. Two additional tools are non-negotiable:
- Multi-Factor Authentication (MFA/2FA) — Even if an attacker has your password, MFA requires a second factor (usually a code from an app like Google Authenticator or a physical security key). Enable MFA on every account that supports it, starting with email and banking.
- Password Manager — A reputable password manager (Bitwarden is free and open-source; 1Password and LastPass are popular paid options) allows you to use a unique 16+ character random password for every account without memorizing any of them. This is the single highest-impact security change most people can make.
Action Checklist: Securing Your Passwords Today
- Download Bitwarden (free, open-source) or another reputable password manager.
- Create a strong master password (a 5+ word passphrase you can memorize).
- Use Flixfer's Password Generator to create a 16+ character random password for every account you add.
- Change your three most critical accounts first: primary email, banking, and your most-used social media.
- Enable MFA (2FA) on all three of those accounts immediately.
- Check haveibeenpwned.com to see if your email has appeared in known breaches.
- Over the next month, update every remaining account through your password manager.