What Makes a Strong Password — A Practical Test, Not a Checklist

The bank's signup form gave my colleague a green checkmark for Summer2024! and called it "Strong."

An offline cracking rig doesn't care about your season or your exclamation point. It cares about how many guesses it takes to reach your secret — and predictable human patterns collapse fast.

This article isn't another password checklist. It's about how to think when you create a password: what attackers actually do, why "complex" and "strong" diverge, and how to pick something you'll live with without reusing it on twelve other sites.

For storage, managers, and breach response, see our Password Security Guide. Here we focus on the password itself — before it ever touches a vault.

Quick answer

The bank's signup form gave my colleague a green checkmark for Summer2024! and called it "Strong."

Strength is measured in guesses, not vibes

Cryptographers talk about entropy — roughly, how unpredictable a password is. Every extra bit of entropy doubles the work for an attacker.

A password cracker doesn't start with random letters. It starts with wordlists: leaked passwords from old breaches, names, sports teams, keyboard walks (qwerty), and every "clever" substitution (@ for a, 0 for o) that millions of people already used.

Offline cracking is the scary scenario: an attacker steals a database of password hashes and runs billions of guesses per second on their own hardware. Your password's strength is entirely about surviving that grind.

Online guessing is slower — login forms rate-limit attempts. But credential stuffing bypasses guessing: attackers use known email/password pairs from breaches and try them everywhere. Your "strong" password fails instantly if you reused it from a site that leaked three years ago.

| Threat | What breaks weak passwords | What helps | |--------|---------------------------|------------| | Credential stuffing | Reuse across sites | Unique password per account | | Dictionary attack | Common words, names, dates | Random or high-entropy passphrases | | Rule-based cracking | Summer2024!, P@ssw0rd | Length + randomness, not patterns | | Offline hash cracking | Short passwords under 10 chars | 14+ random chars or long passphrases |

Why site "strength meters" mislead you

Most meters were built for composition rules from an older era: one uppercase, one number, one symbol, minimum eight characters. They reward Welcome1! and punish correct horse battery staple even when the latter is harder to crack.

Sites enforce minimums because they can't trust users to choose well — not because eight characters with a symbol is magically safe. A meter turning green is necessary for the form, not sufficient for your security.

Practical test: Imagine someone has a hash of your password and a weekend of GPU time. Would they try your pet's name first, or would they need to search a space of trillions of strings? If the answer is the pet's name, the meter lied to you.

Length beats cleverness

Modern guidance from NIST and security researchers converges on a simple idea: long random secrets beat short "complex" ones.

• K9#mP2$x — eight characters, symbols, mixed case. Cracks in seconds to hours offline.
• v7Fm2kL9pQx4nR8w — sixteen random characters. Years to centuries against typical offline attacks.
• dune-orchid-ferry-14-plasma — long passphrase with separator. Strong if words are unrelated and not a famous quote.

The Password Generator on Vertex Solutions produces random strings you can size to each site's maximum allowed length. Use the longest length the form accepts — many still cap at 64 or 128 characters; fill what you can.

Passphrases work when you need something typeable on a TV login or a corporate machine without a manager extension. Use random words (diceware-style), not a sentence from your favorite song. Four unrelated words plus a number or separator often exceeds sixteen characters of real entropy.

Uniqueness is part of strength

A password that's mathematically strong but reused is operationally weak. Attackers don't need to crack your hash if they already have yourpassword from a forum breach and your email logs into banking.

Treat every account as a separate lock. Same key on the front door and the safe deposit box means one copied key opens both.

If remembering unique passwords is impossible — and for humans, it is — that's not a failure of discipline. It's biology. Use a password manager and let the generator create the random part. The "strength" of the secret and the discipline of uniqueness belong together.

Context changes what "strong" means

Not every account needs the same bar:

High value — primary email, password manager, bank, cloud storage that holds tax documents, work SSO. Maximum length, random, unique, plus multi-factor authentication.

Medium — shopping sites with saved cards, social media tied to your identity. Still unique and long; enable MFA where offered.

Low — throwaway newsletter signup with no payment info. A generated random password stored in your manager is fine; don't reuse your email password even here, because password reset flows often touch email.

Shared household — Wi-Fi, streaming family plan. A memorable passphrase can work if it's long and not based on your street address (wardriving databases exist). Prefer a manager shared vault over a sticky note on the router.

What attackers know about you

Personalized attacks use OSINT: your LinkedIn, Instagram geotags, children's names in posts, alumni networks, and breach dumps that list your old passwords.

Rules that fail in practice:

• Name + birth year — first line in custom wordlists
• Company + quarter — AcmeQ3! appears in targeted lists
• Keyboard patterns — 1qaz2wsx, zaq1xsw2
• Leet speak — crackers apply @→a rules automatically
• Mangled famous phrases — still in phrase dictionaries

Random generation sidesteps your biography. If you insist on memorizing, pick words with no connection to your public profile.

The usability trap

The strongest password you reset every month because you can't type it is weaker than a managed random one you never retype.

Friction points:

• Mobile keyboards and special-character layers
• Legacy systems that reject long passwords or certain symbols
• "Confirm password" fields on bad UX that hide characters

Workarounds: manager autofill, paste from generator, or passphrase without symbols when the site blocks them. Never shorten to Summer24 because the mobile form is annoying.

Building your personal standard

Before you click Create account, run this mental checklist:

1. Is it unique? Not used on any other site, ever.
2. Is it long? At least 14 characters for anything that matters; prefer 16+ random.
3. Is it unpredictable? Would a stranger who read your social media still guess it in a million tries?
4. Can I store it safely? Manager entry immediately — not a Notes app titled "Passwords."
5. Is MFA available? Turn it on; password strength is one layer, not the whole wall.

If any answer is no, fix it before you finish signup. Changing a weak password later is always harder — and you may forget which reused cousin you picked.

When "strong" still isn't enough

Even excellent passwords lose to phishing pages that look like your bank, malware that logs keystrokes, and session hijacking after you're already logged in. Strength protects the secret; it doesn't protect you from giving the secret away.

Pair strong unique passwords with:

• Authenticator-based MFA (see Two-Factor Authentication Basics — enable it on email first)
• Skepticism toward unsolicited login links
• Updated browsers and managers that warn on known breach reuse

A note for teams and IT

Organizational policy sometimes still mandates 90-day rotation and composition rules that encourage Password1 → Password2 sequences. If you influence policy, push for length minimums, breach checking, manager adoption, and MFA instead of ritual rotation of memorized secrets.

Employees who understand why length and uniqueness matter comply better than those who treat security as arbitrary form validation.

Limitations

No single workflow covers every what makes a strong password edge case. Browser tools, regex patterns, and calculators each have file-size, encoding, or policy limits. Test on copies, validate outputs against your requirements, and keep originals until you confirm results.

Common mistakes

Rushing without a checklist, skipping verification on a sample file, and assuming defaults match your jurisdiction or platform are the failures we see most often. Slow down on the first run; automate only after the output matches expectations twice.

Real-world examples

Teams usually adopt this workflow when a recurring task — weekly exports, client deliverables, or form validation — starts costing more time in rework than in doing it carefully once. Start with one real document or dataset from this week, not a synthetic demo.

When to use this approach

Use this method when you need a fast, browser-based pass without installing software, when files are within typical size limits, and when privacy policy allows local processing. Escalate to desktop or enterprise tools when compliance, batch volume, or advanced features demand it.

Related tools

• Password Generator

Conclusion

A strong password in 2026 is long, random or high-entropy, and used exactly once. Green checkmarks on signup forms are a starting negotiation with the website, not a security audit.

Generate what you can't memorize. Store what you generate. Assume breach databases will eventually include someone else's mistake — and make sure your secret isn't the same mistake copied to yours.