Passwords protect your email, your bank account, your photos and your identity. Yet weak and reused passwords remain one of the most common ways accounts get broken into. The good news is that creating strong passwords is not complicated once you understand a few principles, and modern tools make it easy. This guide explains what really matters.
Why length beats complexity
Attackers usually do not guess passwords one at a time by hand. They use software that tries enormous numbers of combinations per second, or reuse passwords that leaked from other websites. Every extra character multiplies the number of possible combinations, so length is the single most important factor.
A random password of 8 characters can be cracked in a short time with modern hardware. A random password of 16 characters, using lowercase and uppercase letters, digits and symbols, is far beyond what any realistic attack can try. Current security guidance, such as that from NIST, puts emphasis on length and on checking passwords against known breached lists, rather than on forcing odd character rules.
What makes a password weak
- Common words and patterns: "password", "qwerty", "123456", "iloveyou".
- Personal details: your name, birthday, pet or favourite team.
- Simple substitutions such as "P@ssw0rd". Attackers know these tricks and try them first.
- Short passwords, even if they contain symbols.
- Reused passwords. If one site is breached, criminals try the same email and password on other services. This is called credential stuffing and it works because many people reuse passwords.
Two good ways to build a strong password
1. Random characters from a generator. A password of 16 or more random characters is ideal for accounts you access through a password manager. You never need to remember it. Our Password Generator creates these locally in your browser using the Web Crypto API, and nothing is sent or stored.
2. A passphrase of random words. For the few passwords you must remember, such as your computer login or your password manager's master password, choose four to six unrelated words, for example "lantern-orbit-pickle-meadow-tractor". It is long, easy to type and easy to memorise with a bit of repetition. The words must be random; a song lyric or famous quote is not safe.
Use a password manager
No one can remember dozens of unique, long passwords. A reputable password manager stores them encrypted behind one strong master password, fills them in for you and can warn you if a site has been breached. Browsers also offer built-in managers that are better than reusing the same password everywhere.
Turn on two-factor authentication
Two-factor authentication (2FA) adds a second step after your password, such as a code from an authenticator app, a hardware security key or a passkey. Even if someone steals your password, they cannot log in without the second factor. Enable it first on your email, banking, cloud storage and social media accounts. Authenticator apps and security keys are safer than text-message codes, although any 2FA is better than none.
Do you need to change passwords often?
Regular forced changes tend to push people toward weaker, predictable passwords. Modern advice is to change a password when you have a reason: a breach notice, suspicious activity, or if you shared it. Otherwise, a strong unique password can stay.
A quick checklist
- At least 14–16 characters for important accounts.
- A different password for every account.
- Store them in a password manager.
- Enable two-factor authentication.
- Be careful with phishing: never enter your password after clicking a link in an unexpected email; type the address yourself.
- Do not share passwords by email or chat.
Final thoughts
You do not need to be a security expert to stay safe. Choose long and random, never reuse, let a manager remember for you, and add 2FA. Try the Password Generator to create your next password in one click.