Strong Password Examples

What makes an example "strong"

A strong password is one an attacker is unlikely to guess, even with fast hardware and good guessing tools. That depends on two things: how many possible passwords the method could produce, and whether the attacker's tools try yours early.

People usually judge strength by how a password looks. P@ssw0rd1! has capitals, a digit and symbols, so it looks strong. But attackers do not guess by looks. They start with lists of leaked passwords, dictionary words, names and common patterns, and only later try random combinations. A password that matches one of those patterns falls early, no matter how complex it looks.

So the useful question is not "does it have a symbol?" but "where did the randomness come from?". If it came from your head, it probably follows a pattern. If it came from dice or a secure random generator, it does not.

How we tested the examples

For each weak example below we ran the same estimator that powers our password strength checker: zxcvbn-ts, with the dictionaries the site loads. It estimates how many guesses an attacker would need, using lists of common passwords, words, names, keyboard patterns and dates. We show that figure as bits: log2 of the estimated guesses. Each extra bit doubles the guesses.

These numbers are estimates from one tool, not measurements of a real attack. You can type any example into the checker and it will show the same result, because it runs the same code in your browser. The ratings use the site's own scale: under 28 bits very weak, 28 weak, 36 fair, 60 strong, 80 and above very strong.

We also show the naive figure: length × log2(character pool). This is the number many simple meters show. The gap between the two is the point of this guide.

Weak password examples, and why each one fails

Name plus year: Michael1987

Estimate: about 13.9 bits (roughly 15,000 guesses), very weak. Naive figure: 65.5 bits.

The estimator found "Michael" in its common-password list (as entry #20) and "1987" as a year. Names and birth years are some of the first things guessing tools combine. Adding a capital letter at the start does not help, because that is exactly where most people put it.

Keyboard walk: 1qaz2wsx

Estimate: about 4.9 bits, very weak. Naive figure: 41.4 bits.

On a QWERTY keyboard, this is two columns typed from top to bottom. It feels random to the fingers, but it is in the common-password list as entry #28. qwerty123 scores about 8.1 bits for the same reason.

Word with substitutions: P@ssw0rd1!

Estimate: about 14.3 bits, very weak. Naive figure: 65.7 bits.

Replacing letters with similar symbols (a → @, o → 0) is called l33t substitution. Guessing tools undo these swaps automatically, so the estimator still matched "password", the second entry in its list. The 1! at the end is a very common way to satisfy a "digit and symbol" rule. To catch passwords like this, NIST requires services to check new passwords against a blocklist of commonly used, expected or compromised passwords ^[1]. Password123! scores about 15.5 bits.

Season plus year: Summer2026!

Estimate: about 23.3 bits, very weak. Naive figure: 72.3 bits.

A season, the current year and an exclamation mark. This pattern is popular because it meets most old-style rules and is easy to update when a site forces a change. A football club works the same way: Liverpool2026! is 14 characters long but scores only about 26.6 bits. Length helps only when the extra characters are unpredictable.

Short but random: joou~&z

Estimate: about 23.3 bits, very weak. True entropy: 45.9 bits.

This one was generated at random from 94 printable characters, so it contains no pattern. It is weak for a different reason: it is only 7 characters long. There are about 64 trillion such passwords. That sounds like a lot, but under the site's fast-hash scenario (a GPU rig making 10^11 guesses per second against a stolen fast hash), the average time to find one is an estimate of about five minutes. Randomness needs enough length to matter.

Strong password examples

Both patterns below get their strength from randomness, not from your memory or creativity. We generated each one with Node.js crypto.randomInt, a cryptographically secure random source.

A random 16-character password

s2[nn21~a%fHjPNv — example only, never use it

Each character is drawn from the 94 printable ASCII characters, so the entropy is exactly 16 × log2(94) ≈ 104.9 bits. Under the site's largest scenario, a massive GPU cluster making 10^12 guesses per second, the average time to find it is an estimate of about 590 billion years.

That is far beyond what you need. Its length also clears NIST's 15-character minimum for passwords used on their own ^[1], and CISA's advice to use at least 16 characters ^[3]. You cannot remember a password like this, and you do not need to: it belongs in a password manager. Use one per account. Our password generator makes them in your browser.

A random six-word passphrase

crushable-immunity-sift-upheaval-sash-reason — example only, never use it

Six words picked at random from the EFF large wordlist of 7,776 words. Entropy: 6 × log2(7,776) ≈ 77.5 bits. EFF recommends at least six words from this list ^[2]. Under the same 10^12 guesses-per-second scenario, the average time is an estimate of about 3,500 years. Five words give about 64.6 bits, which drops that estimate to under half a year, so six is the better choice for anything important.

The estimator rates this passphrase about 99.3 bits, very strong - higher than the 77.5 bits above. It recognises the words but does not assume the attacker knows they came from a 7,776-word list. Plan with the lower figure: entropy counted from how a passphrase was generated is the honest number, because an attacker can know the method.

A passphrase is the right choice for the few secrets you must type from memory, such as the master password of a password manager. Are Password Managers Safe? explains why that one password matters so much. For the method behind random words, and for memorable password ideas, see What Is a Passphrase?.

Why the estimator scores the random password lower

If you type s2[nn21~a%fHjPNv into the checker, it shows about 53.2 bits, rated fair. That is not a contradiction. When the estimator finds no pattern, it assumes about 10 options per character, a cautious guess designed for strings a person invented to look random. For a password that really was drawn at random, the exact entropy (104.9 bits) is the correct measure. This is why our generators show exact entropy and use the estimator only for passwords people chose themselves. Password Entropy Explained covers the difference in detail.

Why every example here is now weak

Every strong example on this page has one serious problem: it is published. Anyone can copy it into a wordlist, and attackers build wordlists from exactly this kind of public text. Once a password is printed in an article, a screenshot or a video, its real strength is close to zero, however many bits it had when it was generated.

The same goes for examples on any other site, and for "clever" ideas you read online, such as a famous line with numbers added. Use the examples to see the pattern, then make your own with a tool that generates a fresh one for you. EFF also asks you to use a passphrase for one purpose only, because a passphrase leaked from one account can be tried on your others ^[2].

Examples at a specific length

If a site sets a length limit and you want to see what passwords of exactly that length look like, use our length pages: 8-character, 12-character and 16-character password examples. They generate fresh examples in your browser for each character set and show the entropy and crack-time estimates for that one length.

How to make your own

For most accounts, let a password manager store a random password of 16 characters or more, different for every site. For the few you must remember, generate a passphrase of six random words with our passphrase generator. Before you use any password you chose yourself, check it in the password strength checker; it runs in your browser and shows which part of the password is predictable.

If you write password rules for a website, NIST's current guidance is to require length, check a blocklist and drop composition rules such as "one symbol and one digit" ^[1]. NIST Password Guidelines walks through what that means in practice.