Which of the following is an example of a strong password?

The answer

Among typical multiple-choice options, the strong password is the one that is long and unpredictable — for example fR7!cP02mv9@QeZ8. It mixes uppercase and lowercase letters, digits, and symbols, contains no recognizable word or personal detail, and is at least 16 characters long. A modern equivalent is a passphrase: four or more random, unrelated words strung together (like correct-battery-hinge-vermilion), which is long, memorable, and hard to guess.

Strength comes down to two things working together: length and randomness (entropy). Length matters most because every additional character multiplies the number of guesses an attacker must make. Randomness matters because attackers do not brute-force blindly — they run dictionary and pattern attacks that try common words, names, and predictable substitutions first.

Why the other options are wrong

• Password1 or Qwerty123 — These look mixed-case with a number, but they are among the very first strings any cracking tool tries. Keyboard patterns and the word "password" are in every attack dictionary.
• A name, birthday, or pet's name (e.g., Michael2011) — Personal information is often public on social media and is trivially guessed or researched. Predictable equals weak, no matter the length.
• A single dictionary word, even a long one (e.g., elephant) — Dictionary attacks test whole-word lists in seconds. One word has almost no entropy.
• A short random string (e.g., x7$K) — Random but far too short; a modern GPU can exhaust all 4–6 character combinations almost instantly.

The correct option is the one that fails all of these attack shortcuts: no word, no pattern, no personal data, and enough length that brute force is infeasible.

The bigger picture

Current guidance (reflected in NIST's password recommendations) has shifted the emphasis. Length beats complexity theater. A 20-character passphrase of ordinary words is stronger and more usable than an 8-character jumble of symbols you cannot remember. NIST now discourages forced periodic changes and mandatory symbol rules, because they push people toward predictable tweaks like Password1! → Password2!.

Two habits matter as much as the password itself. First, use a unique password for every account — if one site is breached, credential-stuffing attacks replay that password everywhere else, so reuse turns one leak into many. Second, use a password manager to generate and store long random passwords, so you only have to remember one strong master passphrase. Layer multi-factor authentication (MFA) on top, and even a stolen password usually will not grant access. The slider below shows how password length maps to real-world crackability.