Creating a strong password sounds simple, but most people do it wrong. They add a number to a word they like, capitalize the first letter, and call it done. That password is cracked in seconds. A genuinely strong password follows specific rules — and once you understand them, you'll never go back to weak ones.
Step 1: Make it long — at least 16 characters
Length is the single biggest factor in password strength. Every additional character multiplies the number of possible combinations by the size of your character pool. A 16-character password is not twice as hard to crack as an 8-character one — it's trillions of times harder.
Here's the math in practical terms: an 8-character password using all character types takes about 1 hour to crack at 10 billion guesses per second. A 12-character password: about 3,000 years. A 16-character password: billions of years. The jump from 8 to 16 characters is enormous.
Minimum recommendations by account type: low-value accounts (forums, newsletters) → 12 characters; standard accounts (social media, streaming) → 14–16 characters; high-value accounts (email, banking, password manager) → 16–20 characters.
Step 2: Use all four character types
A password drawn from a larger character pool is exponentially harder to crack than one restricted to a smaller set. The four types are:
- Lowercase letters (a–z): 26 characters
- Uppercase letters (A–Z): +26, pool is now 52
- Digits (0–9): +10, pool is now 62
- Symbols (!@#$%^&*): +32, pool is now 94
Going from lowercase-only (26) to all four types (94) increases the number of possible 16-character passwords by a factor of roughly 40 trillion. Always use all four types unless a site specifically prohibits certain characters.
Step 3: Make it genuinely random
This is where most people fail. "Random" to humans is not actually random. You'll unconsciously avoid certain patterns, choose characters that feel comfortable, and produce passwords that are far more predictable than you realize.
Genuine randomness requires a cryptographic random number generator — the same technology used in encryption and secure communications. Your brain is not a cryptographic random number generator. Neither are dice, unless you use them correctly (Diceware passphrase method).
The safest approach: use a tool that calls crypto.getRandomValues() — the browser's cryptographically secure API. Our password generator uses this exclusively. It never sends your password to any server.
Step 4: Never reuse it
A strong password used on two sites is half as secure as one used on one site. When any site suffers a data breach — and breaches happen constantly — attackers immediately try those credentials on every other site. This is called credential stuffing, and it's one of the most common ways accounts are compromised.
The practical solution is a password manager. You only need to remember one strong master password; the manager generates and remembers a unique strong password for every account. Leading options include Bitwarden (free, open source), 1Password, and Dashlane.
Step 5: Enable two-factor authentication
A strong password is your first line of defense; 2FA is your second. Even if your password is somehow compromised — through phishing, a data breach, or a keylogger — an attacker can't access your account without your second factor. Enable it on every account that supports it, prioritizing email, banking, and your password manager.
What NOT to do (common mistakes)
- Don't use dictionary words, even with letter substitutions (p@ssw0rd is in every cracking dictionary)
- Don't use personal information — birthdays, names, pet names, addresses. Attackers research targets.
- Don't use keyboard patterns (qwerty, 12345, asdfgh) — these are the first things crackers try
- Don't use the same password twice, even a "slightly modified" version
- Don't make it shorter because a site has a low character limit — if the limit is less than 12, that site has poor security practices
The fastest way: let a generator do it
You don't need to construct passwords manually. A cryptographically secure generator creates better passwords in one click than you could manually design in an hour. Use it, copy the result into your password manager, and you're done.