How to Create a Strong Password (and Actually Remember It)

Weak and reused passwords are behind a huge share of hacked accounts. The good news is that strong passwords are not complicated to create - once you understand what actually makes a password hard to crack. Here is a practical, modern guide.

Length beats complexity

For years we were told to use passwords like P@ssw0rd! - short but full of symbols. It turns out that length matters far more than a scattering of special characters. Each extra character multiplies the number of possible combinations, making a password exponentially harder to brute-force.

A random string of 8 characters can be cracked quickly by modern hardware. A 16-character password could take longer than a human lifetime. That is why security experts now recommend at least 12 to 16 characters.

The passphrase trick

A great way to get length that you can still remember is a passphrase - several random, unrelated words strung together, like copper-lantern-drift-village. It is long (so it is strong), yet far easier to recall than a jumble of symbols. Add a number or symbol if a site requires it.

The three rules that matter most

1. Make every password unique. If you reuse one password and a single site is breached, attackers will try that combination everywhere. Reuse is the number-one risk.
2. Use a password manager. It is impossible to remember dozens of unique long passwords, and you shouldn't try. A reputable password manager generates and stores them, so you only remember one master password.
3. Turn on two-factor authentication (2FA). Even a stolen password is far less dangerous when a second factor (an app code or key) is required to log in.

What to avoid

• Personal details - names, birthdays, pet names, or anything guessable from your social media.
• Common patterns like 123456, qwerty, or password.
• Simple substitutions like @ for a - attackers' tools already know these.
• Reusing your email password anywhere, since your email can reset your other accounts.

Put it into practice

You don't have to invent randomness yourself - our Password Generator creates strong, random passwords with the length and character sets you choose, entirely in your browser. Curious how a password you already use holds up? The Password Strength Checker estimates its entropy and how long it would take to crack (test a similar pattern rather than your real, active password).

Strong passwords, one per account, stored in a manager, with 2FA on your important logins - that combination stops the vast majority of account takeovers.