How to Create a Strong Password (and Never Forget It)

What actually makes a password strong

A strong password is not the one stuffed with weird symbols that you scribble on a sticky note. It is the one an attacker would need centuries to guess, even while testing billions of combinations per second on powerful hardware. Password strength boils down to a single idea: how many tries, in the worst case, would someone need to reach it by brute force.

That reframes the whole thing. The right question is not "does this look complicated?" but "how unpredictable is it?". A password like P@ssw0rd! looks clever to a human, yet it is trivial for cracking software — it sits near the top of every leaked-password list. Meanwhile giraffe-tile-thunder-onion looks silly and is far harder to crack.

The most respected guidance today (such as NIST SP 800-63B, from the U.S. standards institute) distills it to three points: favor length, do not force artificial "at least one uppercase symbol" rules, and never demand periodic changes for no reason. What truly protects you is size and randomness.

Length beats complexity

Every extra character multiplies the number of possibilities, which is why making a password longer is far more effective than decorating it. Here is the difference in real numbers, assuming an offline attack that can test 1 trillion combinations per second — an aggressive scenario typical of someone who has stolen a database stored with a fast hash:

Notice the jump: going from 8 to 12 random characters pushes the crack time from 40 minutes to thousands of years. Complexity did not change — four extra characters did. In practice, 12 characters is a reasonable floor for everyday accounts; for critical ones (primary email, bank, password manager), aim for 16 or more.

Entropy explained without the math

Entropy is just a way to measure unpredictability, in bits. Each bit doubles the number of tries needed: 1 bit = 2 possibilities, 10 bits = 1,024, and a 50-bit password already means roughly a quadrillion combinations.

Here is the catch that trips people up: entropy only counts when the password is generated in a genuinely random way. If you pick the password "in your head", the figure collapses, because humans follow patterns (start with a capital, end with "123" or "!", swap "a" for "@"). Cracking tools know all of those tricks and test the leetspeak variants first.

So the entropy that matters is the entropy of the source. A 12-character password drawn by a computer has ~79 real bits. A 12-character password you invented "creatively" might carry 25 effective bits — and fall in seconds. To get a sense of how strong what you use today really is, run it through the Password Strength Checker (the check runs in your own browser, sending nothing to any server).

The mistakes that make passwords easy to crack

Most hacked accounts are not the victims of a genius hacker; they fall to predictable mistakes. The usual suspects:

• Reusing the same password across sites. When one service leaks, attackers try that email and password on dozens of others (a technique called credential stuffing). A recycled password is only as safe as the weakest site you used it on.
• Obvious substitutions. Swapping "o" for "0" and "a" for "@" fools no one — attack dictionaries already include those variants.
• Personal data. Pet name, birthday, license plate, favorite team. All of it is on social media and is the first thing a targeted attack tries.
• Keyboard walks. qwerty, 123456, asdfgh. They top every leaked-password list.
• The "seasoning" at the end. Tacking a 1 or ! onto the end of a common word adds almost no protection.

If one of your passwords has shown up in a breach, its strength no longer matters — replacing it with a unique, random password is the fix.

How to generate a random password in seconds

The most reliable way to get real randomness is to let the machine draw it. A good generator uses the system's cryptographic source (in the browser, crypto.getRandomValues), not the ordinary Math.random, which is predictable.

Use the Password Generator to create a 16-character string mixing uppercase, lowercase, digits and symbols. The practical flow:

1. Set the length (16 for important accounts; 20+ for the master password).
2. Keep every character type enabled — each category widens the alphabet and raises entropy.
3. Generate, copy and paste it straight into the site's signup form.
4. Save it in your password manager (more on that below). You do not need to memorize this one.

Want to double-check the result? Paste the generated password into the Password Strength Checker and watch the entropy estimate climb. Random 16-character passwords usually max out the strength meter.

Passphrases: strong and easy to remember

Random passwords are great — but impossible to memorize. For the few cases where you must remember one by heart (the password manager's master password, your laptop login), the best route is a passphrase: several random words strung together.

The classic method is EFF's Diceware: a list of 7,776 words where each drawn word adds about 12.9 bits of entropy. Four words give ~52 bits (too weak today); six words give ~77 bits, on par with a strong random password, and still fit in your memory.

A six-word example: vinegar copper window tropical stir bath. It looks absurd, and that is exactly why it works — no pattern, no personal data, no dictionary words in a predictable order. The trick is that the words must be drawn at random, not chosen by you (a song lyric or a famous saying has dismally low entropy, because it is already in attack lists).

Password managers and two-factor authentication (2FA/TOTP)

You do not need — and should not try — to remember dozens of passwords. The grown-up solution is a password manager: an encrypted vault that stores a unique, random password for every site. You memorize only one strong passphrase to open the vault; it fills in the rest. That kills password reuse and the temptation to invent weak ones in one move.

Even the strongest password can leak in an attack on the site itself. The defense against that is two-factor authentication (2FA): beyond the password, the login demands a second factor that only you hold. There are three tiers, weakest to strongest:

• SMS. Better than nothing, but vulnerable to SIM swapping. Avoid it for critical accounts.
• Authenticator app (TOTP). The recommended standard. It generates a 6-digit code that changes every 30 seconds.
• Physical security key (FIDO2/WebAuthn). The strongest — phishing-resistant, because the key verifies the site's real domain.

How TOTP works under the hood

TOTP (Time-based One-Time Password, RFC 6238) combines a shared secret — handed to you when you scan the setup QR code — with the current time, sliced into 30-second windows. The app runs an HMAC over those two values and extracts 6 digits. Because both the server and the app know the secret and the clock, they arrive at the same code without exchanging anything over the internet. That is why it works offline and rotates on its own every half minute.

To see it in action (or to recover access when all you have is the "base32" secret written down), the TOTP Code Generator (2FA) computes the 6-digit code from the secret, exactly as the phone app would. It is the same math that quietly protects millions of logins.

Frequently asked questions

Do I need to change my passwords periodically?

Not on a calendar. Current guidance (NIST) is to change a password only when there is evidence of a breach. Forced changes every 90 days tend to make security worse, because they push people toward weak, predictable passwords (password1, password2...).

Is it safe to type my password into an online strength checker?

It depends on where the check happens. Tools that process everything in your own browser (like this site's) never send the password anywhere. Even so, the safest habit is to test a representative password — same length and character types — rather than your real one.

Passphrase or random password: which should I use?

Both, in different contexts. For everything the manager stores, use random 16+ character passwords — you never have to remember them. For the very few passwords you type from memory (the master password, your computer login), use a six-word random passphrase.

Does 2FA protect me even if my password is discovered?

Yes, in most cases. Without the second factor, the password alone will not open the account. The exception is advanced phishing, which tries to capture the TOTP code in real time too — which is why FIDO2 hardware keys, verifying the domain, are considered the gold standard for high-value accounts.

How many characters is ideal?

For everyday accounts, 12 to 16 random characters. For the manager's master password and your primary email (which can reset every other account), 16 to 20, or a six-word passphrase. Beyond that, the weak link becomes reuse and missing 2FA, not length.