How to Create a Strong Password You Can Actually Use

Most password advice still focuses on mixing uppercase, numbers and symbols. But the passwords that get cracked are rarely too short of symbols; they're too short, too common or reused. Here's what actually makes a password strong, and a system that works in real life.

How passwords get broken

Attackers rarely guess one password at a time on a login page. Common methods:

• Leaked databases: when a website is breached, password lists are tested on other sites. If you reuse a password, one breach opens many accounts.
• Guessing software: programs try billions of likely passwords, starting with common words, names, dates, keyboard patterns and predictable substitutions (a → @, o → 0, ! at the end).
• Phishing: fake login pages that trick you into typing your password. No password strength helps here.

What makes a password strong

• Length: each extra character multiplies the number of possibilities. 16 random characters are vastly stronger than 8.
• Randomness: chosen by a computer, not by you. Humans are predictable.
• Uniqueness: a different password for every account.

That's why P@ssw0rd123! is weak despite using every character type: it's a common word with the changes attackers try first.

Check a password

The Password Strength Checker estimates how quickly a password could be guessed and explains what makes it weak. The check runs in your browser; the page's security policy blocks every connection, so the password can't be sent anywhere. Still, the safest habit is to test a password similar to your real one rather than the real one itself.

Generate strong passwords

The Password Generator creates random passwords with your browser's cryptographic random generator. Choose the length and the kinds of characters. Passwords are never stored or sent anywhere; they exist only on the page until you copy one.

Random characters or passphrase?

• Random characters (for example 16–20) are ideal when a password manager fills them in for you.
• Passphrases of four to six random words are easier to type and remember, and strong because of their length. They're good for the few passwords you must type by hand: your computer login, your password manager's master password.

The words must be random. A phrase you chose yourself, like a song lyric or a saying, is much easier to guess.

A system that works

1. Use a password manager. It remembers unique random passwords for every account and fills them in. Most browsers and phones include one, and dedicated managers add features like sharing and breach alerts.
2. Make one strong passphrase for the password manager itself, and write it down somewhere safe at home if you're worried about forgetting it.
3. Turn on two-factor authentication (2FA) for important accounts: email, banking, social media and your password manager. An authenticator app or security key is stronger than SMS codes.
4. Change passwords when a service is breached, rather than on a fixed schedule.

Your email is the master key

Whoever controls your email can reset most of your other passwords. Give it your strongest unique password and two-factor authentication.

Common questions

Should I change my passwords every few months? Current security guidance generally recommends changing them when there's a reason, such as a breach, rather than on a schedule, which tends to produce weaker, predictable passwords.

Is it safe to let my browser save passwords? Built-in password managers are far safer than reusing passwords. Protect your device with a screen lock.

How long should a password be? At least 12 characters for random passwords, more where possible; four or more random words for passphrases.

Summary

• Length, randomness and uniqueness matter most.
• Use a password manager and two-factor authentication.
• Check and generate passwords privately in your browser.