How to Create Strong Passwords and Keep Them Secure

The short answer: a strong password is long, random and used for only one account. Aim for at least 16 random characters, or a passphrase of several unrelated random words. Store your passwords in a password manager, and turn on multifactor authentication wherever it is offered.

No password makes an account impossible to break into, but these habits make the most common attacks far less likely to succeed. This guide explains why each one matters and how to put them into practice.

What makes a password strong

Attackers rarely type guesses into a login page one at a time. More often, they get hold of a leaked database of password hashes and use fast computers to test enormous numbers of guesses, or they try passwords already leaked from other websites. A strong password resists both approaches. It is:

• Long, so there are too many possible combinations to try them all.
• Random, so it doesn’t appear in the word lists and patterns attackers try first.
• Unique, so a leak from one website doesn’t unlock your other accounts.

The US Cybersecurity and Infrastructure Security Agency (CISA) gives the same three-part advice in its guide to using strong passwords, recommending at least 16 characters.

Why length matters most

Each extra character multiplies the number of possible passwords. Strength is often measured in bits of entropy, calculated as the length multiplied by log₂ of the number of possible characters. This formula only applies to passwords that are truly random. The table shows how long it would take to try every possible combination at one trillion guesses per second.

These figures are illustrations, not predictions. Real cracking speed depends heavily on how a website stores passwords, and on average an attacker would find a password after trying about half the combinations. The pattern is what matters: length grows strength much faster than swapping a letter for a symbol.

Randomness and unpredictability

People are bad at being random. We choose real words, names, dates and keyboard patterns, then make predictable changes like capitalizing the first letter, replacing “o” with “0” and adding “1!” at the end. Password-cracking tools are built around exactly these habits, so Summer2024! is much weaker than its length suggests.

True randomness has to come from a computer or from something like dice. A good password generator uses a cryptographically secure random number generator. Ordinary random functions in programming languages, such as JavaScript’s Math.random(), are fine for games but are not designed to be unpredictable enough for security.

Random passphrases are a good alternative when you need to remember or type a password, for example for your computer login or your password manager. Several genuinely random, unrelated words are long, strong and easier to remember than random characters. The UK National Cyber Security Centre explains a simple version of this in its advice on using three random words.

Why reusing passwords is risky

Data breaches are common, and leaked email and password pairs are widely traded. Attackers feed them into automated tools that try the same combinations on many other websites, an attack called credential stuffing. If you reuse a password, one breach at a small website can expose your email, bank or social media accounts.

A unique password for every account limits the damage of any single breach to that one account. You can check whether your email address has appeared in known breaches at Have I Been Pwned, and change the passwords for any affected accounts.

How to generate a strong password

The Password Generator creates passwords with your browser’s Web Crypto API, a cryptographically secure source of randomness. Each character is picked without bias, and the password is never sent to a server, saved or logged.

1. Open the Password Generator.
2. Set the length with the slider, or type a number up to 128 in the box. The default is 16.
3. Choose which character types to include: uppercase letters, lowercase letters, numbers and symbols. The password always contains at least one character from each type you select.
4. Select Generate password. Use Regenerate for a new one, or the eye button to hide it from anyone looking at your screen.
5. Select Copy password and paste it straight into the website’s sign-up form and your password manager.

The tool also shows an estimated strength, using the same length × log₂(character set) calculation described above. It is a guide, not a guarantee.

Choosing the length and character types

• Use 16 or more characters for passwords stored in a password manager. Longer is better when the website allows it, and you never need to type or remember them.
• Include all four character types when you can, because a larger character set adds strength to every character.
• Turn off symbols if a website rejects them. Add a few extra characters to make up for the smaller character set.
• Use a long passphrase for the few passwords you must type from memory, such as your password manager’s main password.

US government guidance points the same way. NIST’s Digital Identity Guidelines (SP 800-63B) tell services to require at least 15 characters for passwords used on their own, to allow passwords of at least 64 characters, and to stop forcing users to change passwords on a schedule unless there is evidence they have been compromised.

Storing passwords safely

Nobody can remember dozens of long, random, unique passwords, and you shouldn’t try. A password manager generates, stores and fills in your passwords, so you only need to remember one strong main password. Many browsers and phones include one for free, and there are dedicated apps too. The NCSC’s guide to password managers explains how they work and what to look for.

Avoid storing passwords in unprotected notes, spreadsheets, emails or chat messages. If you write a password on paper, keep it somewhere private and away from your device.

Add multifactor authentication

Multifactor authentication (MFA), also called two-step verification, asks for something extra after your password, such as a code from an authenticator app, a prompt on your phone, a hardware security key or a passkey. Even if your password is stolen, an attacker still needs that second factor.

Turn it on first for your email account, because email is used to reset the passwords of almost everything else. Then add it to banking, shopping, social media and cloud storage. CISA’s guide to turning on MFA covers the options.

Common password mistakes

• Reusing passwords, or reusing them with small changes like adding a number.
• Using personal information such as names, birthdays, pets or favorite teams.
• Relying on predictable substitutions like P@ssw0rd.
• Choosing short passwords because they’re easier to type, when a password manager could fill them in for you.
• Sharing passwords by email or text message.
• Ignoring breach alerts from websites or your password manager.

Summary

Strong password security comes down to a few habits: make every password long and random, never reuse one, keep them in a password manager, and add multifactor authentication to your important accounts. To create your next password, open the Password Generator.