NIST SP 800-63B sets an 8-character minimum for user-chosen passwords but encourages much longer values, allowing at least 64 characters. For accounts you care about, aim for 14 or more random characters, or a passphrase of 4+ unrelated words. Length matters more than any specific complexity rule because each added character multiplies the keyspace.

No. NIST SP 800-63B explicitly drops mandatory composition rules because they push users toward predictable patterns like 'Password1!'. A long, truly random password from a smaller pool can have more entropy than a short password with every character class. Use length first; mixed classes are a useful multiplier on top of length, not a substitute for it.

Both can be strong if they have enough entropy. A passphrase of 4–6 random words from a large list (such as Diceware's 7,776-word list) gives roughly 12.9 bits per word, so a 5-word passphrase is about 64 bits, and a 6-word one is about 77 bits. Passphrases are usually easier to type and remember, which matters for the few credentials you have to memorize.

Yes. CISA and NIST both recommend password managers so every account can have a unique, high-entropy secret you do not need to remember. You only memorize a single strong master passphrase and protect it with 2FA. Reusing passwords across sites is the single biggest amplifier of breach damage.

Always, where it is offered. NIST SP 800-63B treats multi-factor authentication as a core control for any account with non-trivial risk. Prefer phishing-resistant factors such as FIDO2 security keys or platform passkeys; authenticator-app TOTP is the next-best option. SMS codes are better than nothing but vulnerable to SIM-swap attacks.

Use Have I Been Pwned's Pwned Passwords service, which lets you check a password against billions of breached credentials using a k-anonymity model so the full password never leaves your device. If a generated password appears in the list, regenerate it. Any password you have used elsewhere should be considered exposed if that other site is breached.

Yes, when generation is client-side and uses a cryptographically secure source. This tool runs entirely in your browser using the Web Crypto API's crypto.getRandomValues, the same CSPRNG that OWASP recommends for security tokens. Nothing is sent to a server and nothing is stored. Still, copy the password directly into your password manager rather than pasting it into chat windows or notes apps.