How to Create a Strong Password
Password Generator ·
A strong password is the single most important lock on your digital life — and most people are still using a flimsy one. The good news is that creating a genuinely strong password takes only a few seconds once you understand the four things that actually matter: length, randomness, character variety, and uniqueness. This guide explains each one, shows you how long a password really needs to be, and lets you generate an uncrackable password instantly, right in your browser.
Short on time? A strong password is at least 16 characters long, completely random, mixes letters, numbers and symbols, and is never reused on more than one account. The fastest way to get one is to generate a password with a tool that uses your browser's secure random source — then store it in a password manager so you never have to remember it. |
What makes a password strong?
Password strength is not about looking complicated — it is about being hard to guess. Security researchers measure that with entropy, the number of guesses an attacker would need to try. Four properties drive it.
1. Length
Length is the most powerful lever you have. Every character you add multiplies the number of possible combinations, so each one makes the password exponentially harder to crack. A long, simple-looking password beats a short, "complex" one every time. Aim for 16 characters or more; for the accounts that protect everything else — your email, your password manager — go even longer.
2. Randomness
Humans are predictable. We pick names, birthdays, favourite teams and keyboard runs like qwerty. Attackers feed exactly those patterns into their cracking tools first. True randomness removes the patterns, and the only reliable way to get it is to let a machine choose for you. Our password generator draws every character from crypto.getRandomValues, the browser's cryptographically secure random number generator.
3. Character variety
Mixing uppercase letters, lowercase letters, numbers and symbols enlarges the pool each character is drawn from — from 26 options to roughly 95. A bigger pool means more entropy per character, so variety lets a shorter password reach the same strength. Most sign-up forms expect this mix anyway.
4. Uniqueness
Even a perfect password becomes a weakness the moment you reuse it. When one website is breached, attackers take the leaked email-and-password pairs and try them on banks, email providers and shops — an automated attack called credential stuffing. A unique password per account contains the damage to a single site. A password manager makes this effortless.
How long should a password be?
Length matters so much that it is worth seeing the numbers. The table below shows roughly how long it would take a well-resourced attacker to crack a fully random password that mixes upper- and lower-case letters, digits and symbols, using a fast offline attack. These are estimates, but the pattern is unmistakable.
| Password length | Character mix | Estimated time to crack |
|---|---|---|
| 6 characters | letters, numbers, symbols | Instantly |
| 8 characters | letters, numbers, symbols | A few hours |
| 10 characters | letters, numbers, symbols | Several months |
| 12 characters | letters, numbers, symbols | Thousands of years |
| 16 characters | letters, numbers, symbols | Effectively forever |
The jump from 8 to 16 characters is not twice as strong — it is trillions of times stronger. That is why length is the first thing to get right.
What is password entropy?
Entropy, measured in bits, is the standard way to express password strength. Each extra bit doubles the number of guesses needed, so 50 bits is twice as hard as 49. As a rough guide: under 40 bits is weak, 60–80 bits is solid for everyday accounts, and 100+ bits is overkill in the best possible way. Both our generator and our password strength checker show the entropy of a password live, so you can see exactly where you stand.
Strong vs. weak passwords: examples
| Weak — avoid | Why it fails | Strong — aim for |
|---|---|---|
password1 | Top of every cracking list | q7!Kp2$wZr9#tLxV |
Summer2024 | Predictable word + year | vT4*nE8@mB1!cR6% |
Jessica1990 | Name + birth year | Brave-Otter-Lantern-92 |
Notice the strong examples on the right come in two flavours: a fully random string and a passphrase. Both are excellent — pick whichever you need to type or remember.
7 common password mistakes to avoid
- Reusing the same password across multiple sites.
- Using personal information — names, birthdays, pets, addresses.
- Relying on simple substitutions like
P@ssw0rd; cracking tools know every trick. - Keeping a password too short just because it has a few symbols in it.
- Sharing passwords over email or chat.
- Never changing a password that has appeared in a data breach.
- Storing passwords in a plain text file or on a sticky note.
How to create a strong password in seconds
- Open the password generator.
- Set the length to 16 characters or more.
- Keep uppercase, lowercase, numbers and symbols all switched on.
- Click generate and copy the result.
- Save it straight into your password manager.
Because the generator runs entirely in your browser, your new password is never sent over the internet or stored on a server — it exists only on your screen.
How to remember a strong password
You should not have to. For the handful of passwords you do need to type from memory — your device login and your password manager's master password — use a passphrase: four or more random words that are long and strong yet easy to recall. For everything else, let your manager remember and fill them. Need a short numeric code instead? The PIN generator creates unpredictable PINs.
Test your passwords
Already have passwords you are unsure about? Two free, private checks help:
- Run them through the password strength checker to see entropy and estimated crack time.
- Use the password leak check to find out if a password has appeared in a known data breach — it never sees your actual password thanks to k-anonymity.
Frequently asked questions
What is the strongest type of password?
A long, fully random string of at least 16 characters that mixes upper- and lower-case letters, numbers and symbols is the strongest type for accounts you do not have to type by hand. For passwords you must remember, a passphrase of four or more random words is both strong and practical.
How long should a strong password be?
Aim for at least 16 characters. Length is the biggest factor in password strength: each extra character multiplies the time needed to crack it, so a 16-character random password is effectively impossible to brute-force with today's hardware.
Is a random password better than a memorable one?
For accounts stored in a password manager, a fully random password is ideal because you never have to type it. For the few passwords you must remember, a random passphrase gives you comparable strength with far better memorability.
Are online password generators safe?
A well-built generator is safe when it creates passwords locally in your browser using a cryptographically secure random source and never transmits them. Our generator does exactly that — the password is produced on your device and is never sent anywhere.
How often should I change my passwords?
Modern guidance is to change a password only when there is a reason to — for example, if a service reports a breach or your password leak check shows it has been exposed. A strong, unique password does not need routine rotation.
How do I keep track of so many passwords?
Use a password manager. It stores every unique password in an encrypted vault behind one master password and fills them in automatically, so strong, unique passwords become effortless.