Overview
A strong password isn't about memorable substitutions, swapping a letter for a number, capitalising the first character, tacking on an exclamation mark. Attackers know these tricks cold, and modern cracking tools apply them as some of their first rules. A genuinely strong password is long, random, and unique to one account.
This guide covers what actually makes a password strong (the math behind it), walks through the two main approaches, random character strings versus passphrases, and covers the infrastructure that makes strong, unique passwords realistic across hundreds of accounts. The Password Generator creates a secure password right now, or keep reading to understand why the practices below hold up.
What You Need
- A password manager (essential, more on this below)
- Access to a cryptographically secure password generator
- 2FA (two-factor authentication) turned on for your most critical accounts
Step 1: Understand What Makes a Password Strong
Password strength gets measured in entropy, the number of possible combinations an attacker would need to try before stumbling onto your password by brute force.
Two variables drive that number. Length matters most: more characters means exponentially more combinations. Character set size matters too: more types of characters means more possibilities at every position.
The relationship comes down to Number of combinations = charset_size ^ length.
An 8-character password using only lowercase letters (26 characters) gives you 26^8, or 208 billion combinations. Powerful hardware chews through that in hours.
A 16-character password mixing uppercase, lowercase, digits, and symbols (95 characters) gives you 95^16, a number with 31 digits. Cracking that by brute force would take billions of years on any hardware anyone can conceivably build.
Here's the practical rule: length beats complexity. A 20-character lowercase-only password (26^20, or 19 septillion combinations) actually beats a 10-character password using every character type (95^10, or 59 quadrillion combinations).
That said, combining every character type with real length gets you the best of both worlds, strength plus resistance to the rule-based attacks that target predictable patterns in human-chosen passwords.
Step 2: Choose Between a Random Password and a Passphrase
Two approaches work well here.
Random character passwords pull from the full set, uppercase, lowercase, digits, symbols, to squeeze the most entropy out of every character. A 16-character random password like kR9@mQz#4Np&Wv2L carries roughly 105 bits of entropy. It's the best choice for most accounts, especially ones sitting in a password manager where you never type or memorise the thing manually.
Passphrases string together random words, something like village-marble-frozen-trumpet. Pulled from the Diceware word list (7,776 words), each word adds about 12.9 bits of entropy, so a four-word passphrase lands around 51.7 bits and a five-word one around 64.6 bits. They're faster to type on mobile, easier to remember, and a good fit for your password manager's master password (the one you actually need to memorise) or for anything you type in by hand. The Passphrase Generator builds one for you.
Either approach beats anything a human would invent on their own.
Step 3: Generate a Password
Use a cryptographically secure generator. Not a manual process, not keyboard mashing, not a pattern you come up with yourself. People are bad random number generators. Patterns creep in without anyone noticing.
For a standard strong password, aim for a minimum of 16 characters, include all four character types, and skip repeating characters where the generator allows it.
For a PIN or numeric code, the PIN Generator builds a genuinely random numeric PIN and steers clear of common patterns like 1234, 0000, or a birth year.
The Password Generator on this site runs on the browser's built-in crypto.getRandomValues() API, a cryptographically secure pseudorandom number generator (CSPRNG) that produces statistically random output. Avoid any generator that runs server-side and sends your password over a network.
One rule matters above the rest here: generate a different password for every account. Your email password should differ from your bank's, which should differ from your social media, which should differ from every other service you touch. Nothing else on this list matters as much as that one habit.
Step 4: Store It in a Password Manager
Most people reuse passwords because memorising dozens of unique 16-character strings just isn't realistic. A password manager fixes that outright, and it's probably the single change that improves password security most for an average person.
A password manager generates a strong, unique password for each new account, stores everything in an encrypted vault only you can open, auto-fills credentials in your browser and on mobile, and flags you if a stored password turns up in a known breach.
Your vault gets encrypted with your master password using strong encryption, typically AES-256. Nobody, not even the password manager company, can read what's inside. The master password is the only one you'll need to remember or type from scratch, so a five-word passphrase works well here.
Bitwarden (open source, a strong free tier), 1Password, and Dashlane are all well regarded. All three sync across devices and offer browser extensions and mobile apps.
Step 5: Enable 2FA Alongside Your Password
A strong password by itself won't cut it for your most critical accounts. Phishing, keylogger malware, and social engineering can compromise credentials no matter how strong they are. Two-factor authentication asks for a second piece of evidence, something you have rather than something you know, before a login goes through.
Ranked from strongest to weakest, hardware security keys (FIDO2/WebAuthn) are physical devices like a YubiKey or Google Titan that resist phishing outright, since the browser cryptographically verifies the site before the key ever responds. Authenticator apps generate time-based one-time codes through something like Google Authenticator, Authy, or your password manager, and hold up against SIM-swap attacks. SMS one-time codes are vulnerable to SIM-swapping but still a real step up from no 2FA at all.
Turn on 2FA everywhere it's offered, starting with your email account (top priority, since email resets every other password you own), then your password manager, your bank and investment accounts, and your main social media accounts.
Common Mistakes to Avoid
Reusing passwords is the most dangerous habit on this list, and also the most common. Billions of credentials leak in breaches every year, and reusing a password across sites means a breach at any one of them exposes your account everywhere else. No site is "safe enough" to reuse a password on.
Making slight modifications to old passwords doesn't fool anyone. Password1 becoming Password2 becoming Password! is a well-known attack pattern, and rule-based cracking tools run through every common variation of dictionary words and previously breached passwords automatically. A tweak doesn't make an old password meaningfully stronger.
Using personal information hands attackers a shortcut. Your name, your partner's name, a pet's name, a birthday, an anniversary, an address, a favourite team, these are the first things anyone guessing tries, and much of it sits in plain view on social media.
Writing passwords in plain text defeats the whole point. A sticky note, a file named "passwords.txt", a spreadsheet, none of that counts as acceptable storage. Anyone who gets into your computer, phone, or cloud storage gets every password at once. Stick to a password manager's encrypted vault instead.
Trusting browser-saved passwords without a master password leaves a gap most people don't realise is there. Most browser password stores aren't encrypted behind a user-specific master password by default, so anyone with your unlocked computer can open browser settings and see every saved password. A dedicated password manager closes that gap.
Formula & Methodology
Password entropy:
Entropy (bits) = length × log₂(charset_size)
Common entropy values:
| Configuration | Entropy |
|---|---|
| 8 chars, lowercase only | 37.6 bits |
| 12 chars, uppercase + lowercase | 68.5 bits |
| 16 chars, all ASCII printable (95 chars) | 105 bits |
| 20 chars, all ASCII printable (95 chars) | 131 bits |
| 4-word Diceware passphrase | 51.7 bits |
| 5-word Diceware passphrase | 64.6 bits |
| 6-word Diceware passphrase | 77.5 bits |
Security researchers generally treat 80+ bits of entropy as computationally infeasible to crack by brute force with current technology. A 16-character password drawing on the full printable ASCII set (105 bits) sits well above that line.
The Password Generator defaults to 16 characters across all four character classes, which puts most generated passwords in the 100+ bit range, plenty for ordinary accounts of any kind.