How to Create Strong Passwords (and Actually Remember Them)
What makes a password strong, how random generators and password managers work, and the habits that protect your accounts.
What attackers actually do
Most account break-ins are not clever guessing by a person at a keyboard. They come from automated attacks. Attackers take lists of passwords leaked from other sites and try them on popular services (credential stuffing), or they run software that tries billions of guesses per second against a stolen database of password hashes. In both cases two things protect you: a password that is not on any list, and a password that is not reused anywhere else.
Length beats complexity
Every extra character multiplies the number of possible passwords. A random password using 70 different symbols has about 6 bits of strength per character, so 8 characters give roughly 49 bits and 16 characters give about 98 bits. Each additional character is worth more than swapping an 'a' for '@'. Predictable substitutions like 'P@ssw0rd!' are in every cracking dictionary. Aim for at least 14 to 16 characters for important accounts.
Randomness has to be real
Humans are bad at randomness. We pick names, dates, keyboard patterns and the same few words. A strong password should be chosen by a computer using a cryptographically secure random source. The Password Generator uses your browser's crypto.getRandomValues function, which is designed for security uses, instead of the ordinary random function used in games. It also avoids a subtle bias by rejecting values that would make some characters slightly more likely than others. The password is created on your device and not transmitted anywhere.
It leaves out look-alike characters such as 0 and O or 1 and l, which makes a printed or read-aloud password less error-prone.
Use a password manager
Nobody can remember dozens of long random passwords, and reusing one is the biggest risk. A reputable password manager (built into your browser or operating system, or a dedicated app) stores unique passwords for you, fills them in, and warns you about leaks. You then only need to remember one strong master password. For that one, a passphrase works well: four or five unrelated random words, such as those chosen by dice, are easy to remember and long enough to be strong.
Habits that matter more than any rule
Turn on two-factor authentication, preferably with an authenticator app or a hardware key rather than SMS, for email, banking and your password manager. Your email account matters most, because password resets go there. Never share passwords by chat or email. Beware of phishing: a perfect password is useless if you type it into a fake login page, so check the address in the browser bar. Change a password immediately if a service reports a breach, and do not rely on forced periodic changes, which the current US NIST guidance no longer recommends without evidence of compromise.
A simple setup
Pick a password manager. Generate a 16 to 20 character random password for each account. Set a long passphrase as the master password. Add two-factor authentication to your most important accounts. Store recovery codes somewhere safe and offline. That takes about an hour and removes the great majority of everyday risk.
Passphrases and the dice method
A passphrase is several random words, such as copper-lantern-river-orbit-maple. Chosen truly at random from a list of 7,776 words, as in the well-known diceware method, each word adds about 12.9 bits of strength, so five words give about 65 bits and six give about 78. That is easy to type and remember. The words must be random; a famous quote or song lyric is not safe even if it is long.
Use a passphrase for the few things you must remember, like your computer login and password manager. For everything else let a manager hold long random passwords.
Two-factor authentication compared
Authenticator apps generate a six-digit code that changes every 30 seconds. They are much safer than SMS. Hardware security keys and passkeys resist phishing, since they work only on the real website. SMS codes are better than nothing, but a phone number can be hijacked through SIM-swap fraud. Backup codes are one-time codes for emergencies; print them or store them offline.
Turn on the strongest option each service offers, starting with email, then banking, then social media and cloud storage.
What to do after a breach
If a service you use reports a breach, change that password at once, and change it anywhere else you used it. Check your email address on a reputable breach-notification site to see which services were affected. Watch for phishing messages that mention the breach, and never click links in them; type the website address yourself. Turn on two-factor authentication, and review recent account activity and recovery options, since attackers sometimes add their own.