How to create a strong password you can actually use

A strong password is long, random and used on exactly one site. Everything else — the capital letter, the symbol, the digit stuck on the end — matters far less. Most accounts are lost not to clever attacks but because a password was reused on a site that was later breached, or because it was short enough to guess.

The quickest route here: open the Password Generator, choose Random password for something your browser will remember or Passphrase (words) for something you will type, set the length, and paste the result into the site's password field. It draws every character from your browser's cryptographic random source and shows the entropy in bits as you change the settings. Nothing is transmitted or logged.

Which kind of password for which job

Kind	Use it for	Trade-off
16–20 random characters	Ordinary site logins, stored in a password manager	Unusable to type by hand
A passphrase of 7–8 random words	Your device login and your password manager's master password	Longer, but easy to type on a phone or a TV remote
A random string with no symbols	Systems that reject punctuation, Wi-Fi keys, API keys	Slightly fewer possibilities per character
Nothing at all — a passkey	Sites that support them	Not offered everywhere yet

What "strong" means, in numbers

Strength is measured in bits of entropy: how many guesses an attacker must make on average. For a password whose characters were picked at random, the formula is length × log₂(size of the character set), and appearance changes nothing.

With every character type switched on, this generator draws from 89 characters: 26 lowercase, 26 uppercase, 10 digits and 27 symbols. That gives:

Length	Bits	Possible passwords
8	51.8	about 3.9 × 10¹⁵
12	77.7	about 2.5 × 10²³
16	103.6	about 1.5 × 10³¹
20	129.5	about 9.7 × 10³⁸

Turning symbols off drops the set to 62 characters, so 16 characters give 95.3 bits instead of 103.6 — a real difference, and a much smaller one than going from 8 characters to 16. The cleanest version of the argument: 15 random lowercase letters are worth 70.5 bits, and 12 random letters-and-digits are worth 71.5. Three extra characters bought as much as two extra character classes.

Passphrases

For the handful of passwords you must type from memory, use several random words. This tool's word list holds 1,269 short words, so each word adds log₂(1269) = 10.3 bits:

• 6 words: 61.9 bits
• 7 words: 72.2 bits
• 8 words: 82.5 bits

A longer list is worth more per word: the EFF's 7,776-word list gives 12.9 bits a word, so six words from it reach 77.5 bits. Either way, the words must be chosen by the generator, not by you — a phrase you invented is a phrase someone else can invent. Ticking Add a number appends a random two-digit number, worth about 6.5 bits, which is mainly useful for sites that insist on a digit.

What current guidance actually says

The US National Institute of Standards and Technology publishes the digital identity guidelines most organisations follow (SP 800-63B). Its current requirements for login systems tell you which rules are outdated:

• Passwords used on their own must be at least 15 characters; where a second factor is also required, at least 8.
• Systems should allow at least 64 characters, and should accept spaces and Unicode.
• Systems must not impose composition rules — no "one uppercase, one digit, one symbol".
• Systems must not make you change your password on a schedule. A forced change is required only when there is evidence the password has been compromised.
• New passwords must be checked against blocklists of common and previously breached passwords.

So if a site still makes you rotate every 90 days and rejects your 40-character passphrase because it has no capital letter, the site is behind, not you.

Random has to mean random

Summer2026! satisfies almost every complexity rule ever written and appears in every attacker's guess list. So does P@ssw0rd. People produce patterns even when trying not to: a capital at the start, a digit and a symbol at the end. A generator has no such habits, which is the reason to use one. Random String Generator does the same job when you need to fix the alphabet yourself — for a system that accepts only A–Z and 0–9, for instance.

One password per site

When a site is breached, the leaked email-and-password pairs get tried automatically on banks, mail providers and shops. This is called credential stuffing, and it works only because passwords are reused. Uniqueness turns one company's bad day into one account you reset instead of twelve.

You cannot remember a hundred unique random passwords, and you are not supposed to. A password manager — the one built into your browser or phone, or a dedicated application — generates them, stores them encrypted and fills them in. It also refuses to fill your bank password into a lookalike domain, which is a better phishing defence than being careful.

Add a second factor

For email, banking, and any account that can reset the others, turn on two-step verification. An authenticator app or a hardware security key is markedly stronger than an SMS code, which a SIM swap can intercept. Passkeys, where the site supports them, replace the password with a key stored on your device and cannot be phished or reused.

No password makes an account unbreakable. If the provider is compromised the right way, or if you type it into a convincing fake site, its length will not save you. Length, uniqueness and a second factor reduce the ways things can go wrong and limit the damage when one of them does.

Where it goes wrong

The site silently truncates your password. Some older systems cut at 16 or 20 characters. If a long password stops working after a change you did not make, try the first 16.

Symbols are rejected after the fact. A site accepts # at sign-up and rejects it at login. Generate without symbols for that site rather than fighting it.

You lose the password before saving it. Save it in the manager first, then paste it into the registration form.

You have to type it on a TV or a games console. Use a passphrase, or a random password with Avoid look-alikes switched on, which removes l, 1, O, 0 and a few others and leaves 83 characters.

A shared password sits in a chat thread. For Wi-Fi, print a QR code instead — see How to make a Wi-Fi QR code. Otherwise share it through the password manager.

Questions people ask

Is 12 characters enough? For an account with a second factor, usually. For a single-factor login, 15 or more matches current guidance, and going to 16–20 costs nothing when a manager types it for you.

Should I change my passwords regularly? No, not on a schedule. Change a password when there is a reason: a breach notice, a shared device, a suspicion.

Are password managers safe? They concentrate risk in one place and remove the much larger risk of reuse. Protect the vault with a long passphrase and a second factor.

Is writing passwords on paper acceptable? For a home account, a notebook in a drawer beats reusing one password everywhere. The threat is remote and automated, not a burglar.

Does hashing my password make it stronger? No. Hash Generator computes SHA-256 and similar digests for checking files; sites hash passwords on their own servers with slow, salted algorithms, and a hash you type in is just a longer password.

Next steps

• Generate a password or passphrase: Password Generator
• Generate a key from a fixed alphabet: Random String Generator
• Share your Wi-Fi without dictating it: How to make a Wi-Fi QR code