Password Generator

How long a password needs to be

Strength comes from entropy — the number of possible passwords an attacker must search. Each character multiplies the space by the size of the character set, so length matters far more than complexity.

Estimates assume a well-resourced offline attack against a properly hashed password. They collapse entirely if the site stored passwords badly — which is why reuse is the real danger.

Reuse is a bigger risk than weakness

Billions of credentials from past breaches are freely available. Attackers take those username and password pairs and try them automatically across hundreds of other sites — a technique called credential stuffing. It works because most people reuse passwords.

A unique password per site means a breach at one service exposes exactly one account. This single change protects you more than any amount of added complexity on a reused password.

Use a password manager

Nobody can remember forty unique twenty-character passwords, and a system that depends on it will fail. A password manager stores them encrypted behind one strong master password, fills them automatically, and warns you when a saved password appears in a known breach.

Autofill has a security benefit that is easy to miss: a manager fills credentials only on the domain it saved them for. It will not fill your bank password on a lookalike phishing site, which makes it a genuine defence against phishing rather than merely a convenience.

Reputable options include Bitwarden (free and open source), 1Password, KeePassXC and the managers built into major browsers. Any of them beats a notebook or a spreadsheet.

Passphrases

Four or five genuinely random words — correct-horse-battery-staple — produce a password that is both strong and memorable. The critical word is *random*: chosen with dice or software, not picked by you, since human-chosen words cluster heavily around common vocabulary.

A five-word Diceware passphrase from a 7,776-word list gives about 64 bits of entropy, comparable to a well-made twelve-character random password and far easier to type on a phone or a TV remote. It is the right choice for the handful of passwords you must actually memorise — your device login and your password manager’s master password.

Beyond passwords

• Turn on two-factor authentication everywhere it is offered. It stops a stolen password from being enough on its own.
• Prefer an authenticator app or hardware key to SMS. SIM-swap attacks make text messages the weakest second factor, though SMS is still much better than nothing.
• Adopt passkeys where available. They replace passwords with a device-held cryptographic key, cannot be phished, and are now supported by Google, Apple, Microsoft and a growing list of services.
• Check your accounts on Have I Been Pwned to see which of your credentials have appeared in breaches.
• Ignore forced rotation. Both NIST and the UK NCSC now advise against routine password expiry — it pushes people toward predictable minor variations. Change a password when there is a reason to.