How to create a strong password you can actually use

Most account break-ins don't involve clever hacking. They happen because a password was reused on a site that got breached, or was short and guessable. Fixing both is simple.

Length beats complexity

Password strength is measured in bits of entropy — how many guesses an attacker would need. For a random password it's length × log₂(number of possible characters).

• 8 random characters from letters, digits and symbols: about 52 bits — within reach of a well-equipped attacker offline.
• 16 random characters: about 104 bits — far beyond any realistic attack.
• 20 characters: about 129 bits.

Adding length is more effective than adding symbols. The Password generator shows the entropy of every password it creates.

Random means random

People are bad at randomness: Summer2026! passes most “complexity rules” but is in every attacker's guess list. Let a generator pick characters using a cryptographically secure random source.

Passphrases for what you must type

For passwords you type often (your computer login, your password manager's master password), use a passphrase: several random words like Brook-Tiger-Salad-Pouch-Unit-42. Six random words from a list of a few thousand give around 70 bits — and are much easier to type on a phone.

Never reuse passwords

One unique password per site. When a site is breached, attackers try the leaked email/password pairs everywhere else (“credential stuffing”).

Use a password manager

Nobody can remember 100 random passwords. A password manager (built into your browser or phone, or a dedicated app) generates, stores and fills them. You remember one strong passphrase; it remembers the rest.

Turn on two-factor authentication

For email, banking and social accounts, add a second factor — an authenticator app or a security key — so a stolen password alone isn't enough.