How to Create a Strong Password

A strong password is long, generated randomly, and used for exactly one account, and those three properties matter far more than sprinkling in symbols or swapping letters for lookalike characters. Most advice about passwords fixates on the wrong things, demanding an uppercase letter here and a punctuation mark there while ignoring the two factors that actually determine whether a password survives an attack: how unpredictable it is, and whether reusing it lets one breach unlock everything else you own. Get length, randomness, and uniqueness right and the rest largely takes care of itself.

Why does length matter more than complexity?

Length matters most because each additional character multiplies the number of possibilities an attacker must search, and that multiplication grows explosively. Password strength against guessing is fundamentally about the size of the space the attacker has to cover. Every character you add multiplies that space by the size of the character pool, so growth is exponential in length. Adding one more character to a random password does more for its strength than adding a single required symbol to a short one.

This is why a long, simple-looking random string beats a short, gnarly one. A twenty-character lowercase random password has a vastly larger search space than an eight-character password that mixes cases, digits, and symbols, simply because the exponent is bigger. Attackers exploit short passwords by brute force precisely because the space is small enough to exhaust. Make the space large through length and brute force stops being feasible.

Complexity rules exist to enlarge the per-character pool, which helps, but they hit diminishing returns fast and often backfire by pushing people toward memorable patterns like Summer2024! that attackers anticipate. If you must choose between one more character and one more mandatory symbol, choose the character. Length is the cheapest, most reliable lever you have, and when a password manager remembers the result for you, there is no reason not to pull it hard.

Why does the password have to be truly random?

Randomness matters because attackers do not guess uniformly; they guess smartly, starting with everything humans predictably do. Real cracking does not march through every combination in order. It runs wordlists built from leaked password databases, dictionaries, names, dates, keyboard walks, and every common substitution, in order of likelihood. A password that a human invented almost always sits somewhere in that predictable distribution, which is why “clever” passwords fall quickly while boring random ones do not.

The failure mode is that humans are bad randomness generators. We reach for words, we put the capital at the front and the digit and symbol at the end, we substitute @ for a and 0 for o. Cracking tools know all of this and apply the transformations automatically, so p@ssw0rd is cracked at essentially the same speed as password. The apparent complexity is an illusion because it follows a rule the attacker already models.

True randomness removes the pattern. A password drawn character by character from a defined pool by a good random source has no structure for a wordlist to exploit, so the attacker is forced back to brute force over the full space, which length has already made hopeless. This is exactly the job a generator does well and a human does poorly. Our password generator produces random passwords entirely in your browser, so the secret is created on your own device and never transmitted anywhere. Letting a tool pick the characters is not laziness; it is the only way to get randomness a human cannot fake.

Why is a unique password per account non-negotiable?

A unique password per account is essential because reuse turns any single site’s breach into a break-in everywhere you used that password. When a service is compromised and its password database leaks, attackers take the recovered email-and-password pairs and try them automatically against banks, email providers, and everything else. This is called credential stuffing, and it works because so many people reuse credentials. The strength of the individual password is irrelevant here; if you used it in two places and one leaks, both are compromised.

Uniqueness contains the blast radius. If every account has its own password, a breach at one service exposes exactly one account and nothing more. You rotate that single password and move on, rather than scrambling to change dozens of logins before an attacker gets there first. The difference between reused and unique passwords is the difference between a contained incident and a cascading one.

Uniqueness at scale is only practical with help, which is the real argument for a password manager. No one can memorize a hundred distinct random passwords, and trying leads straight back to patterns and reuse. A manager stores a unique, strong password for every account behind one strong master secret, so the human only remembers one thing while every account still gets its own unguessable credential. That combination, a manager plus a generator, is what makes the ideal actually achievable.

Are passphrases a good alternative?

Passphrases made of several truly random words are an excellent alternative, combining real strength with far better usability, as long as the words are chosen randomly. The idea is to select words at random from a large list and string them together, producing something like correct-anchor-village-tremor. Such a phrase can be as strong as a random character password while being much easier to type on a phone and, if you need to, to remember.

The essential caveat is the same as before: the words must be picked by a random process, not by you. A phrase you compose from a favorite quote, a song lyric, or words that relate to each other is guessable, because it follows the associations attackers model. Random selection from a big wordlist is what gives a passphrase its strength; a chosen phrase is just a long predictable password. The strength comes from the number of words and the size of the list they are drawn from, not from the fact that they are words.

Weak, human-picked phrase:  ilovemydogmax          (predictable, related words)
Strong, random passphrase:  quartz-ledger-otter-brief-noon
                            (words chosen at random, then joined)

The difference is not the words being words.
It is whether a machine chose them at random.

Use whichever style fits where you are typing. For a login you type by hand often, a random-word passphrase is friendlier. For a credential your manager fills automatically, a long random character string is fine. Both approaches win for the same underlying reason: enough unpredictability that guessing is hopeless.

What should you actually do?

In practice, adopt a password manager, generate a long random password or passphrase for every account, and stop trying to memorize or reuse anything but the master secret. The table sums up the priorities.

Two operational notes round this out. First, protect the few passwords you do type, above all your manager’s master password, and turn on two-factor authentication wherever it is offered so that even a leaked password is not enough on its own. Second, do not paste real passwords into unfamiliar websites; a trustworthy generator produces the value locally and never sends it anywhere, which is the whole point of doing the work client-side. Length, randomness, uniqueness, and a manager to make them practical: that is the entire recipe, and it is more effective than any amount of symbol-juggling.