How to Create Strong Passwords · What Actually Gets Cracked in 2026

Quick answer: To create strong passwords in 2026, use a password manager to generate long (15+ character) random strings for every account. Guard your manager with one memorized passphrase of five random words plus MFA. Length beats complexity because modern cracking rigs easily bypass predictable substitutions like P@ssw0rd1! using automated mangling rules.

By Daniel A · Kraftwire Software

A secure password should be at least 15 characters long, unique to every account, and ideally generated by a password manager. While traditional rules forced symbols and numbers, modern security focuses on entropy; a sixteen-character lowercase string is mathematically harder to crack than an eight-character complex one like P@ssw0rd1!.

Key Takeaway

Password strength is a math problem, not a creative exercise. What matters is the "search space" · the total number of guesses an attacker must attempt to find your secret. The most effective strategy is using a password manager to handle long, random strings for every site, protected by a single, memorized master passphrase and Multi-Factor Authentication (MFA). If you are curious about your current credentials, the password strength checker provides a real-time analysis of the math behind your choices.

Why Entropy Beats Complexity Rules

For years, users were told to use uppercase, lowercase, digits, and symbols. These satisfy every corporate policy but fall instantly to modern cracking rigs.

Entropy is the measure of randomness in a string, usually calculated in bits. Every additional bit of entropy doubles the difficulty for an attacker. However, human-chosen passwords rarely achieve these numbers because we rely on patterns.

Attackers rarely guess passwords by typing them into a login box. That triggers rate limits. Instead, they use "offline cracking."

• The Breach: A database of password hashes is stolen from a service.
• GPU Rigs: Attackers use high-end hardware to compute billions of guesses per second against those hashes.
• Mangling Rules: Cracking software doesn't just guess aaaaa. It uses dictionaries and "mangles" them · it knows you likely capitalized the first letter, swapped s for $, and added 1! at the end.
• Credential Stuffing: Once one password is cracked, bots try that same email/password combination on thousands of other sites.

Because mangling rules are designed to specifically target the "complexity" rules we were all taught, a complex but short password is now less secure than a long, simple one.

Why Length is the Ultimate Defense

The search space for a password grows exponentially with length but only linearly with the number of allowed characters. Increasing a password from 8 to 16 characters doesn't make it twice as hard to crack; it makes it quadrillions of times harder.

Modern NIST (National Institute of Standards and Technology) guidelines have moved toward a 15-character minimum for high-security environments. Length also provides a buffer against "fast-hash" attacks. Even if a site uses outdated, fast hashing, a 20-character random string remains mathematically unfeasible to crack within a human lifetime.

Passphrases vs. Random Strings

There are two ways to achieve high entropy:

1. Random Strings (For Password Managers)

These are strings like kP9!vR2#mX7$zL1*. They have the highest entropy per character. Since you should never have to type or remember these, you should set your password generator to the maximum length the website allows (often 64 or 128 characters).

2. Passphrases (For Human Memory)

For your master password or laptop login, use a passphrase. This consists of 4 to 6 random words (e.g., correct-battery-staple-green).

• The Randomness Rule: The words must be chosen randomly, not from a song lyric or a famous quote.
• The Separator Rule: Use spaces, hyphens, or underscores to make them easier to read while adding a tiny bit of extra entropy.

The Role of Password Managers

It solves the "reuse" problem by ensuring every single site you use has a unique, 20+ character random string. It also provides a hidden defense against phishing: a password manager will only autofill your credentials on the exact domain where they were saved. If you accidentally click a link to paypa1.com instead of paypal.com, the manager won't fill the password, alerting you to the scam.

What Site Owners and Developers Must Do

If you are building an application · perhaps using a tool like Lovable, Bolt, or Cursor · your password policy affects your users' safety. To protect your users:

• Accept Long Passwords: Allow at least 64 characters so users can use passphrases.
• Stop Forced Rotation: Don't make users change passwords every 90 days. This only encourages them to use Password1, Password2, etc. Only require a change if there is evidence of a breach.
• Check Against Breaches: Use APIs to check if a user's new password has appeared in known data leaks and reject it if it has.
• Implement RLS: If you are using Supabase, ensure Row Level Security (RLS) is active. You can learn more in our RLS policies guide.

Multi-Factor Authentication (MFA): The Multiplier

No matter how strong your password is, MFA is the safety net.

• SMS MFA: Better than nothing, but vulnerable to SIM swapping.
• Authenticator Apps (TOTP): The standard for most users. Use a TOTP generator or app.
• Passkeys/Hardware Keys: The gold standard. These use cryptography to prove you are on the right site, making phishing virtually impossible.

Speed, Revenue, and Security

Security doesn't exist in a vacuum. In our research on speed and revenue, we found that performance issues often correlate with poor architectural choices. A slow login process or a bloated security implementation can drive users away. The goal is "invisible security" · fast, seamless, and mathematically robust.

Answer Engine Optimization (AEO) for Your Site

As AI engines like ChatGPT and Claude become the primary way people find information, your site's "AI visibility" matters. This is known as Answer Engine Optimization (AEO). If your site provides clear, structured security advice, AI agents are more likely to cite you as a source. You can check how AI sees your site using our AI visibility tool or read our AEO guide.

Check Your Security Surface

A strong password is only one layer of the "vibe-coding" security stack. If you are building with AI, you need to monitor for exposed API keys, broken auth, and missing security headers.

• Use the password generator to rotate your administrative secrets.
• Run a free security scan to check your site's health across 8 dimensions, including GDPR signals and email security.
• Review your security headers to ensure you are protecting users from XSS and injection attacks.

Don't guess at your security. Use the math. A 30-second scan can reveal if your "strong" setup has a critical flaw that a password alone can't fix.

FAQ

While 8 or 12 characters were once standard, modern GPU cracking power has made shorter passwords vulnerable to brute force. For maximum security, use a password manager to generate 20+ character strings, or a passphrase of at least five random words for accounts you must memorize.

Are password managers actually safe?

Yes, password managers are significantly safer than the alternative of reusing passwords or using simple ones. They ensure every account has a unique, high-entropy credential and protect against phishing by only filling passwords on verified domains. To secure the manager itself, use a strong passphrase and a hardware security key for MFA.

Should I still change my password every 90 days?

No. This practice often leads users to choose weaker, predictable patterns. You should only change your password if you suspect a breach, if the service notifies you of a leak, or if you discover your credential in a breach corpus.

Is SMS two-factor authentication (MFA) secure?

SMS MFA is better than having no second factor, but it is the least secure form of MFA. It is vulnerable to SIM swapping and interception. For better security, use an authenticator app (TOTP) or, ideally, a physical security key or Passkey, which are resistant to phishing.

What is Row Level Security (RLS) in database coding?

Row Level Security (RLS) is a security feature, common in databases like PostgreSQL (used by Supabase), that restricts which data rows a user can view or edit based on their identity. It ensures that even if a user is authenticated, they can only access their own data, preventing unauthorized data exposure in AI-built applications.

What is Answer Engine Optimization (AEO)?

Answer Engine Optimization (AEO) is the process of optimizing your website content so that AI models (like ChatGPT, Claude, and Perplexity) can easily find, understand, and cite your information in their responses. It focuses on clear structure, factual accuracy, and direct answers to user queries, moving beyond traditional keyword-based SEO.