To generate a strong password based on a word, don't just decorate the word with capitals, symbols and a year: cracking tools try those patterns first. Instead, use the word as one part of a passphrase and add at least three or four more words picked at random, ideally by a generator. The randomness of the extra words, not your chosen word, is what makes it strong.
People search for ways to "generate a password from a word" because a word is memorable. That instinct is sound. Long passphrases made of words are both easier to remember and harder to guess than short strings of symbols. The trouble is the way most people turn a word into a password. This guide explains why the usual tricks fail, how to build a passphrase around a word you like, and what NIST, CISA and the UK's NCSC actually recommend.
Key takeaways
- A password built from one word plus swaps like @ for a or a year on the end is easy for cracking tools, because attackers try those patterns first.
- If you want a word in your password, keep it but add several truly random words, and count only the random words toward its strength.
- NIST SP 800-63B sets a 15-character minimum for passwords used on their own and tells services to block dictionary words and context-specific words.
- Random words from a generator are stronger than words you choose yourself, and a password manager removes the need to remember most passwords at all.
Why a single word plus tweaks is weak
The classic recipe goes like this: take a word such as sunshine, capitalize the first letter, swap letters for look-alike symbols, and add a number and an exclamation mark. You get Sunsh1ne2026!. It looks complex, it ticks every box on an old-style password form, and it is a poor password.
- Attackers start with dictionaries. Password-cracking tools commonly work through word lists and then apply rules for common changes such as capitalizing the first letter, swapping
afor@orofor0, and appending years and symbols. - Substitutions add little. The NCSC says that if you swap characters, such as replacing the letter "o" with a zero, your password "won't be significantly stronger, but it will be harder for you to remember", because criminals know these tricks too.
- Personal words are guessable. The NCSC warns against passwords based on significant dates, sports teams, and family or pet names, noting that most of these details can be found on social media.
NIST's guidance for services reflects the same thinking. NIST SP 800-63B tells services to compare new passwords against a blocklist that includes breached passwords, dictionary words and "context-specific words, such as the name of the service, the username, and derivatives thereof". A password built from one dictionary word is exactly what that blocklist is designed to catch.
What makes a password strong
Strength comes from how many guesses an attacker would need, and that depends on two things: length and genuine randomness.
| Guidance | What it says |
|---|---|
| NIST SP 800-63B | Passwords used on their own must be at least 15 characters. Services should allow at least 64 characters, accept spaces, and not impose composition rules such as mandatory symbols. |
| CISA | Use passwords of "at least 16 characters", or a passphrase of "4 – 7 unrelated words", and a different password for each account. |
| NCSC | Combine three random words to make a password that is long and strong enough for most purposes but easier to remember. |
| EFF | For dice-generated passphrases, "for most applications, we suggest making a six-word passphrase." |
Notice that none of them says "pick a word and add symbols". They all point toward length built from random parts.
How to build a strong passphrase around a word
If you want a word that means something to you in your password, here is a safe way to do it.
- Pick your word, but avoid anything public: your name, your pet's name, your company, your street or your favorite team.
- Add random words. Use a password generator, such as the From your words mode in our password generator, to add three or four extra words. Don't choose them yourself, because people tend to pick related or predictable words.
- Mix the order. Put your word somewhere other than the start, for example
Lantern-Otter-sunshine-Velvet-Quarry. - Use a separator if you like. Hyphens, dots or spaces make it easier to read and type. NIST tells services to accept spaces, though some older sites still reject them.
- Count only the random words. Assume an attacker could guess your chosen word. Judge the strength by the random words alone, and add more if you need to.
- Use it once. A strong password reused on several sites is only as safe as the weakest of those sites.
Why counting only the random words matters
A rough way to compare passphrases is to ask how many possible combinations exist. Each word picked at random from a list of about 1,000 words multiplies the number of guesses by about 1,000, which is roughly 10 bits of strength. With EFF's long word list of 7,776 words, each word adds nearly 13 bits: three random words give about 39 bits, and six give about 77, which is why EFF puts a six-word passphrase at about 2 to the power of 77 possibilities.
Your own word adds very little to that if an attacker can guess it. That is why the random part has to do the heavy lifting.
Using our password generator
Our free password generator has a From your words mode built for exactly this. Type one or more words you'll remember, choose how many random words to add (one to six), and it builds four variants around your word:
- Passphrase: your word mixed in among random words, with a random separator and a random two-digit number, for example
Upward_Auction_Sunshine_87_Seminar. - Mixed case and symbols: random capitals inside your word and a random digit or symbol between every word, for example
renderer8liquid8SUNShiNE=marina. - Word plus random characters: your word joined to a block of random letters, digits and symbols.
- Easy to type: all lower case with spaces and one extra random word, handy on a phone.
Your word lands at a random position, and every random part comes from the browser's secure random generator (crypto.getRandomValues). The extra words come from EFF's 7,776-word long list, so each one adds nearly 13 bits. Each variant shows its own strength estimate, and the estimate deliberately counts your word as 0 bits, assuming an attacker already knows it. The tool also shows the weak, decorated version of your word (such as Sunsh1ne2026!) and labels it as one to avoid.
With your word plus three random words, the passphrase variant comes out at about 53 bits, a solid choice for most accounts. For a password manager's master password, add five or six random words. If you'd rather not use a word of your own, the Passphrase mode generates random words only, and the Random password mode makes character strings for your password manager. Everything runs in your browser, and nothing you type or generate is sent or stored.
Where a memorable password still matters
You don't need to remember most passwords. CISA recommends a password manager, which it describes as a program that "generates, stores and even fills in all your passwords". NIST tells services to allow password managers and autofill. Let the manager create long random passwords for every site.
That leaves a few passwords you do have to remember:
- the master password for your password manager,
- your computer or phone login,
- your main email account, which can reset everything else.
Those are where a long passphrase built from random words shines. Protect them further with two-step verification; our guide to two-factor authentication for website admins covers the options, and many services now offer passkeys that avoid passwords altogether.
Quick checklist
- At least 15 to 16 characters, and more for important accounts.
- Several words chosen at random, not by you.
- Nothing public or personal as the only secret.
- No reliance on
@,0or!swaps for strength. - A different password for every account, stored in a password manager.
- Two-step verification or passkeys turned on for email, banking and admin logins.
For a fuller walkthrough of password policy for a team, see our strong password guide.
Frequently asked questions
How do I generate a password based on a word?
Keep your word, then add three or more random words from a generator and join them with a separator, for example Quarry.sunshine.Otter.Velvet. Don't rely on swapping letters for symbols or adding a year, because cracking tools try those changes automatically.
Is a password generator using my own words safe?
It depends on how your words are used. Words you pick yourself are more predictable than random ones, so treat them as a bonus, not the main source of strength. A generator that adds several truly random words around your word is far safer than one that only decorates it. Ours runs entirely in your browser, so your words are never uploaded.
How long should a passphrase be?
NIST sets a 15-character minimum for passwords used on their own, and CISA suggests 16 or more characters or 4 to 7 unrelated words. EFF suggests six words for dice-generated passphrases. More random words always make a passphrase stronger.
Are three random words enough?
The NCSC considers three random words strong enough for most purposes. For high-value accounts such as email or a password manager, adding more random words gives a bigger safety margin, especially if the words come from a small list.
Should I add numbers and symbols to a passphrase?
They can help a little, and some sites require them. But NIST tells services not to force composition rules, and the NCSC says common substitutions don't make passwords significantly stronger. Adding another random word usually helps more than adding a symbol.
Related reading
- How to Create a Strong Password: A UK Guide Based on NCSC Advice: How to create a strong password using the NCSC's three random words, why length beats complexity, and where password managers, 2SV and passkeys fit in 2026.
- Passkeys for Business Websites and Admin Logins: A Guide: Passkeys for business websites explained: how FIDO2 and WebAuthn stop phishing, support in Google, Microsoft, WordPress and Shopify, and a rollout plan.
- How to Add Two-Factor Authentication to Your Website Admin: How to add two-factor authentication to WordPress, cPanel, your hosting account and registrar, with backup codes and passkeys so you never get locked out.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 12 November 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
