How to Generate a Strong Password

What makes a password strong

Password strength comes down to entropy — how many guesses an attacker must try. Entropy grows with length and with the size of the character set. Every extra character multiplies the search space, which is why length matters far more than clever substitutions like replacing "a" with "@". A 16-character random password is dramatically stronger than an 8-character one, even if the shorter one looks more complicated.

As a rule of thumb, aim for at least 16 characters for important accounts, mixing uppercase letters, lowercase letters, numbers and symbols. For accounts that allow it, 20 characters or more is even better. Randomness is essential: a password built from dictionary words or personal details is weak no matter how long it is, because attackers try those patterns first.

Why "clever" passwords fail

Human-invented passwords follow predictable patterns, and cracking tools know them all. Capitalizing the first letter, adding "!" at the end, swapping letters for lookalike numbers — these tricks add almost no security because every password-cracking dictionary already includes them. The same goes for keyboard walks like "qwerty123" and dates like birthdays or anniversaries.

Reusing passwords is the biggest risk of all. When one site leaks its database — and large leaks happen every year — attackers test those same credentials on every other service. A unique password per account turns a breach of one site into an isolated incident instead of a domino effect across your whole digital life.

• Never reuse a password across two accounts.
• Avoid dictionary words, names, dates and keyboard patterns.
• Do not trust "clever" substitutions — crackers try them first.
• Longer beats more complicated: 16+ random characters is the goal.

How to generate a secure password

The safest way to create a password is to let a generator do it. A good generator uses your device's cryptographic random number source, so the result is genuinely unpredictable. Choose the length (16 to 32 characters is a sensible range), include all four character types, and let it produce something like "9f$Kp2!wQz#8vLm@4xR". It looks unreadable — that is the point. You are not supposed to memorize it.

If a site restricts which symbols you can use, a token generator with custom character sets can match its rules. Some older systems limit passwords to letters and numbers; in that case compensate with extra length, since a longer alphabet-free password can still be very strong.

Storing passwords: use a password manager

A generated password is useless if you cannot remember it, and writing passwords in a notebook or a text file defeats the purpose. A password manager stores all of them in an encrypted vault protected by one strong master password — the only password you ever need to memorize. It can also autofill logins, warn you about reused passwords, and generate new ones on the spot.

Pick a reputable manager, protect it with a long master passphrase and two-factor authentication, and keep a secure backup of your vault. Then go through your important accounts — email first, then banking, then everything else — and replace each password with a fresh, unique, generated one.

Check the strength of passwords you already use

If you are unsure whether your current passwords are good enough, a password strength analyser can estimate how long they would take to crack. It looks at length, character variety and known patterns, and estimates the time a modern cracking rig would need. Anything measured in seconds, minutes or hours needs replacing immediately; anything measured in centuries is doing its job.

Run this check on your most important accounts first — especially your email, because a compromised inbox lets an attacker reset almost every other password you own. After email, work through banking, cloud storage and social accounts, then the rest.

Passphrases: the memorable alternative

If random strings feel unmanageable, consider a passphrase: four or five words chosen at random, like "correct horse battery staple". A passphrase is easier to type and remember than a string of symbols, and because each word adds roughly 13 bits of entropy when drawn from a large list, four random words can be as strong as a 12-character random password.

The key word is random. A passphrase built from a song lyric or a famous quote is weak, because attackers try those first — the same rule as for passwords. Use a generator that picks words from a large wordlist with a cryptographic random source, and never reuse the same passphrase across accounts. For the one master password of your password manager, a passphrase is often the best choice of all: it is the single secret you must memorize, so make it one you can actually type reliably.

Two-factor authentication: the second lock

Even a perfect password can be stolen — through phishing, a keylogger, or a breach. Two-factor authentication (2FA) adds a second check: after your password, the site asks for a six-digit code from an authenticator app on your phone. The code changes every 30 seconds and is tied to a secret only your phone holds, so a stolen password alone is no longer enough to get in.

Turn on 2FA for email, banking, cloud storage and social accounts first — in that order. Prefer an authenticator app over SMS codes, which can be intercepted. And save the backup codes each site gives you when you enable 2FA: if you lose your phone, they are your way back in.