Create a strong password – and what is actually secure in 2026

The most important change of recent years: length counts for more than complexity. In July 2025 the US standards institute NIST published the fourth revision of its guideline SP 800-63B, replacing the 2017 edition. In section 3.1.1.2 it requires services to accept passwords of at least 15 characters when the password alone is used to sign in; only together with a second factor may the minimum be 8 characters. Services must allow at least 64 characters, must not impose character classes (so no forced capital letter, digit and symbol), must not require periodic changes, and must check new passwords against a blocklist of known, expected and compromised passwords. They must allow password managers and autofill, should accept spaces and Unicode, and may no longer offer security questions or password hints.

Germany's BSI gives a rule of thumb with two routes: short and complex with at least 8 characters and four character types, or long and less complex with at least 25 characters, for example as a string of words. For the Wi-Fi password it recommends at least 20 characters, because attacks there are possible offline. An 8-character password with three character types is only enough, according to the BSI, if a second factor is active as well. On changing passwords, the BSI is clear in its press release of 31 January 2025, «Passwortwechseln war gestern» (roughly: changing passwords is yesterday's advice): the advice to change passwords routinely is outdated, because over time it produces weaker passwords; you change a password when there is evidence of a breach or of someone else getting in.

NCSC Switzerland names on its page «Device security, passwords and access control» at least 12 characters of upper- and lower-case letters, numbers and symbols for online services, and likewise at least 20 characters for Wi-Fi. It advises a separate password for every service, a password manager that also supports the second factor, and changing passwords immediately if you suspect someone else knows them. So the three authorities' figures differ – 12, 15 or 25 characters – but the direction is the same. Our recommendation in this guide follows the strictest value for passwords you have to remember (a passphrase, well over 20 characters) and 20 characters for random passwords from the manager.

The image of a hacker guessing a password character by character is misleading. According to the Verizon Data Breach Investigations Report 2026, which analyses over 22,000 confirmed breaches, stolen credentials were involved in 36 % of breaches; credential abuse was the initial access in 13 % of cases, and the human element played a role in 62 %. The passwords come from three sources: data breaches at services that stored passwords poorly protected; infostealers, that is malware that lifts saved passwords straight off the device; and phishing, where you type the password yourself into a fake page.

Have I Been Pwned shows the scale: the collection «June 2026 Stealer Logs», added on 15 June 2026, contains according to the site 56.3 million email addresses and 124 million passwords from infostealer logs of various origins. With lists like these, attackers run credential stuffing: they automatically try the email address and password on hundreds of other services. That only works because passwords are reused – which is why «a separate one for every account» matters more than any symbol. In Switzerland, the study «SME Cybersecurity 2026» by NCSC Switzerland and partners shows the same pattern: among badly hit businesses, password hacking at 32 % was the second most common type of attack after phishing at 39 %, and only 55 % of SMEs had fully rolled out multi-factor authentication (→ Over 35,000 Swiss SMEs hit by serious cyberattacks – and only one in four tests its backups).

Against phishing, a strong password is no help at all – you hand it over voluntarily. Here a password manager helps in a different way: it only fills in credentials on the domain they were saved for. If the field stays empty on a supposed hotel or bank page, that is a warning sign, as the current case of fake hotel bookings reported by NCSC Switzerland shows (→ Hotel phishing with a 7.5 per cent «cashback» targets TWINT accounts – Switzerland's NCSC warns). And the second factor is no cure-all either: there, the fraudsters asked for the confirmation code under a pretext as well and so got round two-factor authentication. Only passkeys and hardware keys are truly phishing-resistant – more on that below.

The best-known table on this is published every year by the US security firm Hive Systems, most recently on 14 July 2026. It calculates how long an attacker needs to crack a randomly generated password from a stolen password hash by brute force. The assumptions for 2026: the service stored the passwords with bcrypt (cost factor 10), the attacker rents 16 graphics cards of the RTX 5090 type, and there is no lockout, no limit on attempts and no second factor. Under these assumptions, an 8-character password of letters, digits and symbols holds out for 132 years according to Hive Systems – in 2024 it was still 225 years, in 2025 164. An 8-character password of lower-case letters only, by contrast, falls in about two weeks, for around $3,400 in rental costs.

The table itself is available as an image; we therefore could not take over further values for longer passwords. More important than the individual figures anyway are the caveats Hive Systems itself names: the times apply only to genuinely random passwords that have not appeared in any data breach. A password that is in a word list or has leaked before was cracked by a single RTX 5090 in Hive Systems' example in around three seconds. And if a service stored its passwords without bcrypt or with a weaker method, all the times shrink drastically.

For you this means: length decides whether an attacker with stolen hashes has any chance at all; every additional character multiplies the effort. That is why we recommend 20 characters for random passwords from the manager, even though NIST requires 15 – the extra characters cost you nothing, because you never type them. Whether your password is on a list, on the other hand, is not decided by its length but by whether you have reused it somewhere.

The BSI, NCSC Switzerland, the UK's NCSC and NIST all recommend or require one – the BSI with the simple argument that you then only have to remember one good master password, NIST with the rule that services must allow password managers and autofill. The benefit is clear: only with a manager is «a separate, long random password for every account» sustainable in everyday life. Add to that the phishing protection from filling in only on the right domain and the built-in check for leaked and reused passwords.

The risks are just as clear. First, the master password: it protects everything, so it must be a long passphrase, used nowhere else, with a second factor – see the tab «The one password you have to remember». Second, vulnerabilities in the programs themselves: in August 2025 the security researcher Marek Tóth showed at DEF CON 33 how the browser extensions of several password managers could be tricked by clickjacking into filling in on foreign pages; who reacted how is in our comparison (→ Best password managers 2026: 1Password, NordPass, Bitwarden and Proton Pass compared). Third, an outage or loss of access – emergency access and an occasional export to a safe place guard against that.

Browser or device managers (Apple Passwords, Google Password Manager) versus a dedicated manager (Bitwarden, 1Password, NordPass, Proton Pass): the built-in ones are free, always there and perfectly adequate for many people, as long as you stay in one world – only Apple devices, or only Chrome and Android. If you mix an iPhone and a Windows PC, share passwords within the family or want passkeys and two-factor codes in one place, you are better off with a dedicated manager. The prices (as of 16 October 2026, US dollars, billed annually): Bitwarden is free with no device or password limit, Premium costs $1.65 per month ($19.80 a year), Families $3.99 per month; 1Password Individual $3.99 per month ($47.88 a year), Families $5.99; NordPass is free with one active session, Premium according to TechRadar $1.24 per month on the 2-year plan; Proton Pass is free, Plus costs $2.99 per month. Details, strengths and weaknesses are in the comparison (→ Best password managers 2026: 1Password, NordPass, Bitwarden and Proton Pass compared).

A passkey replaces the password with a key pair: the private key stays on your device or in your keychain, the service only knows the public one. When you sign in, you confirm with Face ID, a fingerprint or your device passcode – there is nothing you could type into a fake page, and nothing that can be stolen if the service is breached. The BSI names passkeys in its press release of 31 January 2025 as the password-free alternative: because no password is entered any more, criminals cannot capture one either.

How widespread this is can be seen in the figures of the FIDO Alliance, which is responsible for the standard: on 7 May 2026 it reported over 5 billion passkeys and 75 % of respondents with at least one passkey activated; on 15 October 2026 there were, according to FIDO, around 7 billion passkeys, and at the 15 large consumer services of the «Passkey Index» more than a third of successful sign-ins now run via passkey – according to FIDO almost three times faster than with a password and classic two-factor sign-in. All participating services that measure phishing reported fewer successful attacks after the roll-out, FIDO says.

In September 2026 NCSC Switzerland classified the methods in its technology brief «Security categories for authentication procedures, methods and services». It distinguishes the categories «low», «medium» and «high»; an asterisk marks methods that protect against real-time phishing and man-in-the-middle attacks. Username and password alone sit in «low» – such methods, says NCSC Switzerland, should in principle no longer be used, even over an encrypted connection. Password plus SMS code or plus authenticator app sits in «medium» without an asterisk, and NCSC Switzerland calls the security of SMS-based methods questionable in principle. Synchronised passkeys, as Apple and Google distribute them via the keychain, reach «medium*», that is phishing-resistant; FIDO2 hardware keys without synchronisation reach «high*». In practice that means: if a service offers passkeys, set them up – and keep the password only as a fallback, as long and unique as described here. Our step-by-step guide shows how to set up a passkey, prompts, an authenticator app and backup codes on the account that matters most (→ Set up 2-Step Verification on your Google Account – prompts, app, key or passkey).

Forced symbols: since the fourth revision, NIST forbids services to impose character classes, and the UK's NCSC calls the old advice about random characters, symbols and numbers simply unhelpful. A «!» at the end or a «0» instead of an «o» confuses you, not the cracking program. Regular changes: the BSI considers them outdated, NIST forbids services to require them. You change a password when there is a reason – a breach notice, a sign-in you did not make, a phishing email with correct personal details.

Password strength meters: the bar that jumps from red to green usually only measures character classes and length – not whether your password is on a breach list. «Summer2026!» turns green and is still guessed in seconds. Rely on length, randomness and the check against data breaches that Apple, Google and the password managers have built in. «Saving passwords in the browser is unsafe»: that was true when browsers stored passwords unencrypted. Today Apple and Google store them encrypted in the keychain or in the Google Account, check them against breaches and fill them in only on the right domain – that is safer than a reused password in your head. What matters is that the device itself is locked with a passcode and free of malware, because infostealers target exactly these stores.

Security questions: «name of your first pet» is often on social media, and NIST in section 3.1.1.2 explicitly forbids services to offer security questions or password hints. If you have to fill one in anyway, enter a made-up answer – a second random password – and save it in your password manager with that account.