How to Create a Strong Password (and Why Random Beats Clever)
Most account takeovers don't involve a hacker in a hoodie cracking encryption. They happen because someone reused a weak, guessable password that had already leaked in a previous breach. The good news: strong password hygiene is genuinely simple once you understand what actually matters — and most of the "clever" tricks people rely on make passwords weaker, not stronger.
Length beats complexity
This is the single most important rule, and it's backed by research. Modern guidance from the US National Institute of Standards and Technology (NIST SP 800-63B) emphasises length over forced complexity. Each additional character multiplies the number of combinations an attacker must try, so a long passphrase is exponentially harder to crack than a short string of symbols. Aim for at least 16 characters. Our password generator creates random 16+ character passwords in one click.
Random beats memorable
The patterns humans invent — pet names, birthdays, keyboard walks like "qwerty123", or swapping "a" for "@" — are exactly what attackers test first, because everyone uses them. These tricks add almost no real security. Truly random strings have far higher entropy, the mathematical measure of unpredictability. Check how any password scores with our password strength checker; you'll quickly see that "P@ssw0rd!" is weak while a random 16-character string is effectively uncrackable by brute force.
Never, ever reuse passwords
If you use the same password across sites, a single breach exposes every account that shares it. Attackers automate this with "credential stuffing" — taking leaked email/password pairs and trying them everywhere. You can check whether your own credentials have appeared in a known breach using the free, reputable service Have I Been Pwned. The fix is one unique password per site.
Use a password manager
"A unique 16-character random password for every site" sounds impossible to remember — and it is, which is the point. A password manager generates and stores them all, and you only memorise one strong master password. It also fills credentials only on the genuine site, which quietly protects you from phishing.
Turn on two-factor authentication
Even a perfect password can leak. Two-factor authentication (2FA) adds a second step — ideally an authenticator app or hardware key rather than SMS — so a stolen password alone isn't enough to get in. Enable it everywhere that offers it, starting with your email, which is the master key to password resets.
For developers: store passwords correctly
If you build apps, never store plain-text passwords, and never hash them with fast algorithms like MD5 or SHA-256. Use a slow, salted algorithm built for the job — bcrypt is the standard. See exactly how it works with our bcrypt hash generator, and read more in our guide to choosing the right hash. The OWASP Password Storage Cheat Sheet is the authoritative reference.
Bottom line
Go long, go random, never reuse, store everything in a password manager, and switch on 2FA. That's 99% of personal account security handled — and none of it requires being a security expert.
