How to Create a Strong Password (And Why Yours Probably Is Not)

Length beats complexity, by a lot

Password strength is entropy — how many possibilities an attacker must search. Every extra character multiplies that search space, while adding a symbol to a short password barely moves it.

Generate one with no exploitable pattern using the password generator, which uses your browser’s cryptographic random source and never transmits anything.

Reuse is the actual risk

Billions of username and password pairs from past breaches are freely downloadable. Attackers replay them automatically across hundreds of other sites — credential stuffing — and it works because most people reuse passwords.

The strength of your password is almost irrelevant if a site stored it badly and you used it elsewhere. A unique password per site means one breach exposes exactly one account. This single change protects you more than any amount of added complexity.

Check which of your credentials have appeared in breaches at Have I Been Pwned.

Use a password manager

Nobody can remember forty unique sixteen-character passwords, and any system depending on it fails. A password manager stores them encrypted behind one strong master password and fills them automatically.

The security benefit people miss is anti-phishing: a manager fills credentials only on the exact domain it saved them for. It will not fill your bank password on a lookalike site, which makes it a real defence rather than merely a convenience.

Bitwarden is free and open source; 1Password, KeePassXC and the browser-built-in managers are all reasonable. Any of them beats a notebook or a spreadsheet.

Passphrases for the few you must memorise

You need to remember perhaps three passwords: your device login, your password manager master password, and your email. For those, four or five genuinely random words are both strong and memorable.

The word "random" is doing the work. Words you choose yourself cluster around common vocabulary and personal associations. Words chosen by dice or software do not. A five-word Diceware passphrase gives roughly 64 bits of entropy — comparable to a well-made twelve-character random password, and far easier to type on a phone or TV remote.

Rules that make passwords worse

• Forced 90-day rotation. Both NIST and the UK NCSC now advise against it, because it pushes people to Summer2026! then Autumn2026!. Change a password when there is a reason to.
• Maximum length limits. A site capping passwords at 12 characters is often storing them in a way that should worry you.
• Blocking paste. This actively discourages password manager use, making passwords weaker.
• Security questions. Your mother’s maiden name and first school are frequently public. Treat the answers as second passwords and store random strings in your manager.
• Mandatory symbol rules that push everyone to end passwords with ! — an entirely predictable pattern.

Beyond passwords

• Turn on two-factor authentication everywhere it is offered — it stops a stolen password being enough on its own.
• Prefer an authenticator app or hardware key to SMS. SIM-swap attacks make text messages the weakest second factor, though SMS still beats nothing.
• Adopt passkeys where available. They replace passwords with a device-held cryptographic key that cannot be phished, and are now supported by Google, Apple, Microsoft and a growing list of services.
• Protect your email above everything. Whoever controls your email can reset every other account you own.