There is no single “optimum” password for every account. For most people, the strongest practical approach is to use a different, randomly generated password for each service and store them in a password manager. If you must remember a password, use a long, unique passphrase. Add multifactor authentication (MFA) or a passkey wherever the service supports it.
How do I create a good password?
- Use a password manager for passwords you do not need to memorize. Generate a different password for every account and save it in the manager. That way, a breach at one service does not expose a password you reused elsewhere. NIST recommends password managers and notes that autofill can help protect against some mistyped or deceptive website addresses. See NIST’s Digital Identity Guidelines Implementation Resources FAQ.
- Make any password you must remember a long, unique passphrase. Use several unrelated words rather than a familiar quotation, personal fact, or phrase published as an example. Do not reuse a passphrase on another account.
- Turn on MFA or set up a passkey where available. These can add protection beyond the password itself, though the available methods and their security differ by service.
- Change a password if there is evidence it was exposed or compromised. Routine calendar-based changes are not a substitute for unique passwords and MFA.
NIST’s consumer guidance offers “cassette lava baby” as an example of a passphrase, but explicitly warns readers not to use that published example. Create your own instead. For more detail, see NIST’s password guidance.
As an Amazon Associate I earn from qualifying purchases.
How long should a password be?
For a password you create and remember, NIST’s consumer guidance recommends at least 15 characters. In its current SP 800-63B-4 requirements for organizations that verify passwords, NIST requires a minimum of 15 characters when a password is used as the only authentication factor; it permits a minimum of eight characters when the password is part of MFA. Those are requirements for verifiers, not a promise that every website accepts passwords of those lengths. Follow the service’s stated limits.
NIST’s verifier requirements also say services should allow passwords of at least 64 characters. They must not impose other composition rules, such as requiring a mix of uppercase letters, numbers, and symbols. This is a rule for the service, not a reason to assume every account accepts a long password. See NIST SP 800-63B-4, Authentication and Lifecycle Management.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Length helps make exhaustive guessing harder, but it cannot make a password impossible to guess. NIST’s 2025 consumer page illustrates the difference with simplified estimates: it says an eight-character lowercase password has about 200 billion possible combinations, while enumerating all 15-character lowercase combinations would take more than 500 years at an illustrative rate of 100 billion guesses per second on a modern PC. These are not universal crack times: actual outcomes depend on how a password was chosen, the attacker’s method and hardware, and how the service stores passwords. A targeted guess, stolen password database, phishing attack, or malware may bypass the assumptions behind exhaustive search.
Should my password have special characters and numbers?
Not because a rule says it must. NIST’s current verifier requirements prohibit services from requiring particular character types, such as a number or symbol. A longer password is generally more useful against guessing than a short one padded with predictable substitutions. A password manager can generate a unique password that meets the specific service’s allowed characters and length.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Do not confuse complexity with protection against every threat. A phishing page can trick you into entering a long password, and keylogging malware can record what you type. NIST’s password-strength guidance explains that added length or complexity does not defeat those attacks. See NIST SP 800-63B-4, Appendix A: Strength of Passwords.
How does a password manager work?
A password manager stores account credentials so you can use a different password for each service without memorizing them all. It can generate passwords and fill them in when you sign in. Its main security benefit is reducing the temptation to reuse one memorable password across many accounts; autofill can also help avoid entering credentials on a lookalike address.
- Use a unique, generated password for each saved account.
- Protect the manager account with MFA if it offers that option.
- Check that it works with your devices and browsers, and understand how you can recover access if a device is lost or you forget the manager’s main password.
- When choosing a service, check whether it supports password-manager autofill instead of blocking it.
A manager concentrates many credentials behind one account, so securing that account and knowing its recovery process matter. NIST’s consumer advice recommends using a password manager; its implementation FAQ discusses unique passwords and autofill. The FAQ is available at NIST’s Digital Identity Guidelines Implementation Resources.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What do MFA and passkeys add?
MFA requires more than one kind of evidence to sign in, so a stolen password alone may not be enough to access the account. NIST lists authenticator apps, push notifications, text codes, and USB security devices as examples, but they do not provide identical protection. Its consumer guidance specifically warns that text codes are particularly vulnerable.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
A passkey is another sign-in option, not a stronger password. Passkeys can resist phishing because they are tied to the legitimate service rather than being a secret you type into any page. Availability depends on the service and your devices. If you are considering a physical security key for MFA or passkey sign-in, first confirm that the accounts you care about support it; a key is not required to make a password strong. NIST explains these options in its consumer password guidance.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhen should I change a password?
Change it when you have evidence it was compromised—for example, if the service tells you credentials were exposed or you learn that you entered them on a phishing site. NIST’s current verifier requirements say services must force a change when there is evidence of compromise, but must not require periodic changes as a routine policy. For your own accounts, prioritize replacing a compromised password with a new, unique one and securing the account with MFA where possible.
Are passwords going extinct?
No. Passkeys and other alternatives are available, but adoption and compatibility vary among services and devices. NIST’s Digital Identity Program lead Ryan Galluzzo has said, “It’s going to be a long road to completely kill the password,” adding, “There are lots of great alternatives out there, but you’re always going to be constrained by what technology people have available.” Until the accounts you use support a suitable alternative, unique passwords stored in a manager remain a practical way to protect them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
