What makes a strong password in 2026?
Long beats complicated: a passphrase of four or more random words (like "bike-cloud-lemon-plug") is stronger and easier to remember than a short jumble of characters. For everything except your master password, let your password manager generate them: automatically unique and strong.
The old rules (at least one capital, digit, and symbol) produced predictable passwords: Welcome2024! ticks every box and cracks in seconds. Modern guidance, including from standards bodies like NIST, centers on length instead. Every extra character multiplies the possibilities; a phrase of four random words gives you dozens of characters you can still remember.
In practice you only need to know one or two passwords yourself: the master password of your manager and perhaps your computer login. Make those word phrases. Everything else is generated by your password manager: twenty random characters per service, never reused, filled in automatically.
Just as important as strength is uniqueness. A strong password used on ten sites is worthless on all ten after one leak. Unique-and-reasonably-strong beats ironclad-but-reused, and uniqueness is exactly what the manager automates for you.