What Is a Strong Password, and How Do You Create One That Is Really Secure?

Most of us choose passwords we can remember: a name, a date of birth, a phone number, or the usual password with an extra digit. The trouble is that whatever makes a password easy to remember also makes it easy to guess. This guide explains what a strong password actually is, how passwords get cracked in practice, which habits make them weak, and how to protect your email and other important accounts with the Password Generator, a password manager and two-factor authentication.

What is a strong password?

A strong password is one that even a computer making billions of guesses per second cannot find in a reasonable amount of time. Two properties create that strength: length and randomness. Looking complicated is not enough on its own; P@ssw0rd! has a symbol, digits and a capital letter, yet it is one of the first passwords that cracking tools try.

The reason becomes clear when you look at how attacks work. Attackers rarely try passwords on a website's login page, because sites block them after a few failed attempts. The real danger comes when a site's database leaks. The attacker then holds the hashed versions of the passwords and can guess on their own computer without any limit: first lists of common and previously leaked passwords, then the same passwords with predictable rules such as a capital first letter, @ instead of a, or a year at the end, and finally every possible combination.

Entropy: password strength in plain terms

The strength of a password that was generated truly at random is measured as "entropy", in bits. Every bit of entropy doubles the number of possibilities an attacker has to try. If each character is picked at random from a set of N characters, the entropy of the password equals its length multiplied by the base-2 logarithm of N.

A standard English keyboard has 94 printable characters: 26 lowercase letters, 26 uppercase letters, 10 digits and 32 symbols. Each random character from this set carries a little over 6.5 bits of entropy, so a random 16-character password drawn from it has about 105 bits.

To make these numbers concrete, imagine an attacker making a trillion guesses per second against a fast hash. They would try every possible random 8-character password in under two hours, but a 16-character password would take them more than a trillion years. Real speeds depend on the type of hash and the hardware, but the pattern holds: every extra random character makes the attacker's job dozens of times harder.

One important condition: this calculation is only valid for a password that really was generated at random. A password such as Ali@1991! is nine characters long, but because it is built from common patterns, it falls in the very first stages of an attack.

Common mistakes that make passwords weak

• One password for several accounts: the most dangerous mistake of all. When some unimportant site leaks, attackers automatically try the same email address and password on email providers, social networks and online shops.
• Personal information: your own name or your child's, a date of birth, a phone number, an ID number, a licence plate or your favourite team; information that can often be found on social media.
• Simple substitutions: p@ssw0rd instead of password, or $ instead of s, adds no security; these rules have been built into cracking tools for years.
• A year or a symbol at the end: 2026, 123 or ! after a word are among the first variations tried, and so is changing 2025 to 2026 when you update a password.
• Keyboard patterns: qwerty, 1qaz2wsx and 123456 show up on the lists of the most common leaked passwords.
• Unsafe storage: sending a password in a messaging app, or keeping it in a phone note or a screenshot that syncs to cloud storage.

Passphrases: passwords you can remember

For the few passwords you really do have to memorise, such as the master password of your password manager or the login for your laptop, a passphrase is a good choice: several random, unrelated words in a row. A passphrase also gets its strength from randomness. If each word is picked at random from a list of 7,776 words, as in the Diceware method, which chooses words by rolling dice, each word adds about 13 bits of entropy, and six words give more than 77 bits.

Do not "choose" the words yourself; a famous line of poetry, a proverb or a meaningful sentence is not random, however long it is. It is also better to build the passphrase from plain unaccented letters, because some systems have trouble with other characters in passwords. For all your other accounts, where a password manager fills in the password for you, a random string is shorter and more practical. The Password Generator on this site does both: its Mode menu switches between a random string and a passphrase drawn from that same 7,776-word list; the passphrase generator page opens it on that mode.

Create a strong password with the Password Generator

The Password Generator creates the password inside your browser with crypto.getRandomValues, the cryptographically secure source of randomness that browsers provide for security work. The generated password is not sent to any server and is not stored anywhere. The steps:

1. Leave the Mode menu on Password for a random string. The same menu also holds Passphrase and PIN, so the passphrase described above and a PIN of 3 to 12 digits come from this one tool.
2. Use the Length slider to pick a length from 4 to 128 characters; the default is 16. For email and sensitive accounts, choose 20 or more.
3. Choose the character sets: Uppercase, Lowercase and Numbers are on by default. Ticking Symbols adds 26 symbols such as !@#$%.
4. If you will read the password from paper or type it by hand, turn on Exclude ambiguous to leave out look-alike characters such as 0, O, 1, l and I. For a guest Wi-Fi password, you can also make a Wi-Fi QR code instead of reading the password out.
5. At least one of each is ticked by default: it guarantees one character from every set you selected, as long as the length leaves room for one per set. Leave it on when a site insists on a digit or a symbol.
6. Click Generate. Generate 10 creates ten passwords at once; because At least one of each is on, every one of them already contains a character from each set you chose, so you can simply take the first. The list is only there in case you would rather pick one that is easier to read.
7. Copy the password with Copy and paste it straight into your password manager and the site's form.

With the default settings (16 characters from 62 letters and digits), the entropy is about 95 bits, and turning on symbols (88 characters) raises it to about 103 bits. If a site does not accept symbols, untick them and increase the length to 20; at about 119 bits, the result is even stronger than a 16-character password with symbols. You do not have to work the figure out yourself: the line under the result reports it, as About 95 bits of entropy with the default settings. The Strength label below the password is only a simple indicator based on length and character types; the real measure is still length and randomness.

Password managers: the only practical way to use a different password everywhere

Nobody can memorise random, different passwords for dozens of accounts, and nobody is expected to. A password manager keeps all your passwords in an encrypted vault and asks you for just one strong passphrase. Most password managers fill in login forms automatically, and because they match the site's address, they usually do not fill in the password on a fake page that only looks like the real site; real help against phishing.

• The password manager built into your browser or operating system is the simplest way to start, and it is available on the devices that sync with the same account.
• Standalone password managers such as Bitwarden (open source, with a free plan) or KeePassXC (open source and fully offline) work across different browsers and operating systems.
• Turn on two-factor authentication for the password manager itself as well, and keep its recovery codes somewhere safe that is not your phone.

Two-factor authentication: a second layer of protection

Even the strongest password can be typed into a phishing page or stolen by malware. Two-factor authentication (2FA) means that logging in requires something from a device you have, in addition to the password. Its methods are not equally secure:

Write down the backup codes shown during setup and keep them somewhere safe, so you do not lose access to the account if you lose your phone. And never send a verification code to anyone; messages along the lines of "send us the code we just sent you" are among the most common scams.

A strong password for your email

Your email account is your most important account, because almost every service sends its password reset links there; whoever takes over your email can change the passwords of most of your other accounts as well. For your main email address, do the following:

• Create a random password of at least 20 characters that is not used anywhere else.
• Turn on two-factor authentication with an authenticator app or a passkey.
• Keep the recovery phone number and recovery email address up to date; a number you no longer have can become a way in.
• Check the list of devices and sessions signed in to the account every so often, and sign out any you do not recognise.
• Search for your email address on haveibeenpwned.com to see whether it appears in known data breaches.
• Only enter your email password on a page whose address you opened yourself, never from a link that arrived in a message.

When should you change a password?

Forced periodic password changes, every three months for example, are no longer recommended; the guidelines of the US standards body NIST also say that services should not require them, because they push people towards predictable changes such as altering the last digit of the password. Keep a good password, but change it immediately if the service announces a data breach or your email address turns up in a breach list, if you have sent the password to someone or typed it on a public device, if you notice unfamiliar activity in the account, or if you have used the same password somewhere else.