Password security
How to create strong passwords
Learn how to create passwords that resist cracking: what makes them strong, why length beats complexity, and how to store them.
Document summary
A practical guide to creating strong passwords: length, randomness, passphrases, and how to store them safely.
Key takeaways
- Length is the strongest single factor
- Random beats memorable for anything important
- A password manager makes strong passwords usable
What makes a password strong
Strength comes from the number of possible combinations, which grows with length and character variety. A 16-character random password has vastly more combinations than a 10-character one with symbols.
Dictionary words fail because crackers test word lists first. Personal details fail because they are guessable from public profiles.
- Use 16 characters or more where the site allows
- Mix cases, digits, and symbols when permitted
- Avoid words, names, dates, and keyboard patterns
- Never reuse a password across sites
Generate one with the tool
- 1
Open the password generator in your browser.
- 2
Set the length to at least 16 characters.
- 3
Enable the character sets the target site allows.
- 4
Copy the result into your password manager, not into chat or email.
Passphrases when generation is not allowed
Some systems require memorable passwords or block paste. In that case, build a passphrase from four or five unrelated words with a separator, which is long and easy to type while staying resistant to word-list attacks.
Never use a phrase that appears in songs, quotes, or your social media.
Store passwords safely
- Use a password manager with a strong master password
- Enable two-factor authentication where available
- Rotate passwords after a breach announcement
Frequently asked questions
How long should a password be?
16 characters is the practical baseline; 20 or more where the service allows. Length matters more than symbols.
Are passphrases safe?
Yes, when they combine several unrelated words. Length and unpredictability make them resistant to word-list attacks.
Should I use a password manager?
Yes. A manager stores unique strong passwords for every site, so one breach cannot cascade.
Is the generated password sent anywhere?
No. Generation runs locally in your browser.
