Most people know they should use strong passwords. Fewer know what "strong" actually means today, and almost nobody can remember forty different random strings. The good news is that you don't have to. This guide explains how attackers really guess passwords, what makes a password hard to crack, how to create one you can actually remember, and how to manage all the others without losing your mind.
Why weak passwords still get broken
Very few passwords are cracked by someone sitting at a login page typing guesses. Most are exposed in one of three ways:
- Data breaches and credential stuffing. When a website is breached, its list of email addresses and passwords (or password hashes) often ends up online. Attackers then try those same email and password pairs on other sites, such as email, banking and shopping. If you reused the password, the attacker gets in without guessing anything.
- Offline cracking. If a breached site stored password hashes, attackers can run billions of guesses per second against them on ordinary graphics cards. Short passwords, dictionary words and common patterns like
Summer2026!fall quickly. - Phishing. A convincing fake login page simply asks you for the password. No amount of complexity helps if you type it into the wrong site.
That leads to the two rules that matter most: every important account needs a unique password, and each password should be long and unpredictable. Everything else is detail.
What actually makes a password strong
Security people measure password strength in entropy, the number of guesses an attacker would need in the worst case, written in bits. Each extra bit doubles the work. Two things drive entropy: how long the password is and how unpredictably it was chosen.
Length beats complexity
A password made of random characters from the full keyboard (about 94 printable characters) gives roughly 6.5 bits per character. That means:
- 8 random characters ≈ 52 bits, which is within reach of a determined offline attack.
- 12 random characters ≈ 79 bits, which is strong for most purposes.
- 16 random characters ≈ 105 bits, which is far beyond practical brute force.
Notice that adding characters helps much more than swapping letters for symbols. P@ssw0rd looks complex, but cracking tools try those substitutions first, so it's weak. A long, random password is strong even if it only uses letters and numbers.
Randomness beats cleverness
The entropy math only works if the password was chosen randomly. Humans are bad at randomness: we pick names, dates, keyboard patterns (qwerty, 1q2w3e), favorite teams, and we capitalize the first letter and add 1! at the end. Attackers build those habits into their guessing rules. A password you invented yourself is almost always weaker than it feels.
That's why a password generator is the best starting point. It picks characters at random, so there's no pattern to exploit. You choose the length and which character sets to include, such as lowercase, UPPERCASE, numbers and symbols.
Current guidance from the experts
The US National Institute of Standards and Technology (NIST) publishes digital identity guidelines (SP 800-63B) that many organizations follow. Its recent guidance pushed back on several old habits:
- It favors longer passwords and asks services to allow long passwords and passphrases, including spaces.
- It advises against forced composition rules like "must contain one symbol and one number", because they produce predictable patterns.
- It advises against forced periodic password changes without a reason, since people respond by making tiny, predictable edits. Change a password when there's evidence it was exposed.
- It recommends that services check new passwords against lists of known breached passwords and reject them.
In short: long, unique and not previously breached matters more than a sprinkling of symbols.
How to create a strong password you can remember
You only need to memorize a handful of passwords: your password manager's master password, your main email account, and perhaps your computer login. For those, use a passphrase.
Step 1: Pick random words, not a sentence you'd say
The diceware method picks words at random from a list of 7,776 words using dice. Each word adds about 12.9 bits of entropy, so six random words give roughly 77 bits, which is comparable to a 12-character random password and far easier to remember. Something like orbit candle velvet hammock tulip ferry is strong; a famous quote or song lyric is not, because attackers use those too.
Step 2: Make it memorable with a picture
Imagine a scene that links the words: a satellite in orbit holding a candle, wrapped in velvet, napping in a hammock full of tulips on a ferry. Odd mental pictures stick surprisingly well.
Step 3: Add separators if a site requires them
If a site insists on numbers or symbols, add them between words rather than at the end: orbit-candle-7-velvet-hammock-tulip. It satisfies the rule without making it harder to remember.
Step 4: Test it, then practice it
Run it through a password strength checker to make sure it isn't short or pattern-based, then type it a few times a day for a week until it's automatic. For extra caution, test a similar example rather than the exact password you'll use.
For everything else, generate and store
For the dozens of other accounts you have, such as shopping, streaming, forums and utilities, don't memorize anything. Generate a random password of 16 or more characters for each one and store it in a password manager. Well-known options include Bitwarden, 1Password, the built-in managers in Apple devices and Google Chrome, and others. They fill passwords for you, sync across devices, and many warn you when a saved password appears in a known breach.
A password manager also helps protect against phishing: it won't autofill your bank password on a lookalike domain, which is a useful warning sign.
Turn on two-factor authentication
Even a perfect password can be phished or leaked. Two-factor authentication (2FA) adds a second check, so a stolen password alone isn't enough. From strongest to weakest, common options are:
- Passkeys or hardware security keys, which are resistant to phishing because they're tied to the real website.
- Authenticator app codes (time-based one-time passwords).
- SMS codes, which are better than nothing but vulnerable to SIM-swap attacks.
Prioritize 2FA on your email account first. Whoever controls your email can reset almost every other password you have.
Common password mistakes to avoid
- Reusing passwords, even "just for unimportant sites". Breaches of unimportant sites are how important accounts get hijacked.
- Personal details like names, birthdays, pets or addresses, many of which are public on social media.
- Predictable updates such as changing
Winter2025!toSpring2026!. - Sharing passwords in plain text over chat or email. Use your password manager's sharing feature instead.
- Security questions with real answers. Treat them like extra passwords and store random answers in your manager.
A simple plan you can finish this weekend
- Install a password manager and create a six-word passphrase for it.
- Change your email password to a new unique passphrase and turn on 2FA.
- Update your banking, payment and primary social accounts with generated passwords from the password generator.
- Over the next few weeks, replace reused passwords whenever you log in to an older site.
Handy tools along the way: the password generator for new passwords, the password strength checker for testing a passphrase style, the random number generator if you want to roll virtual dice for diceware, and the URL parser for checking the real domain of a suspicious login link before you type anything.
Frequently asked questions
How long should a password be?
For generated passwords stored in a manager, 16 characters or more is a good default. For passphrases you memorize, aim for five or six random words.
Are passphrases really as strong as random passwords?
Yes, if the words are chosen randomly. Six random words from a large list are about as strong as a 12-character random password, and much easier to remember.
Should I change my passwords regularly?
Current guidance says no, unless there's a reason, such as a breach, a phishing attempt or a shared password. Unique, strong passwords don't need routine changes.
Is it safe to use an online password generator?
A reputable generator creates the password and shows it to you; it shouldn't store it. For extra peace of mind, use your password manager's built-in generator for your most sensitive accounts.
Are password managers safe?
For most people, a reputable password manager protected by a strong master passphrase and 2FA is far safer than reusing passwords or keeping them in a notes app.
