How to Create a Strong Password

Last updated: September 2026

Most advice on how to create a strong password hasn't caught up with how attacks and defenses have actually changed. Here's what genuinely matters, in order of impact.

1. Length matters more than complexity

NIST's current digital identity guidelines (SP 800-63B) shifted away from mandatory complexity rules — forced special characters, mandatory capital letters — toward emphasizing length instead. A 16-character password of just lowercase letters can carry more entropy than a shorter password crammed with symbols. Aim for at least 16 characters where a service allows it.

2. Randomness beats anything you'd think of

Humans are bad at generating randomness. Even when we try to be unpredictable, we fall back on patterns — a real word, a capital letter at the start, a birth year at the end — and those patterns are exactly what cracking tools are built to try first. A password generated by a cryptographically secure random process avoids that entirely.

3. Never reuse a password across accounts

When one service is breached, attackers try the leaked username/password pairs against every other major site — a technique called credential stuffing. A strong, unique password everywhere means one breach doesn't cascade into every account you own.

Four ways to actually build one

Use a generator, not your head

The password generator on this site creates a cryptographically random password in your browser, with no manual pattern-guessing involved.

If you need to remember it, use a passphrase

Four or more unrelated random words is easier to recall than a random string, at comparable strength. Try Memorable mode.

If you need to type it manually and often, go pronounceable

A password that alternates consonants and vowels is faster to enter on a TV remote or game console. See the pronounceable generator.

Check the actual strength before you commit to it

Use the entropy calculator to see the real bit count behind any password you're considering — it's calculated locally, nothing is sent anywhere.

How this is checked: the length-over-complexity guidance reflects NIST SP 800-63B's current digital identity guidelines, the credential-stuffing risk is documented in OWASP's authentication cheat sheet, and every recommendation links to the specific tool on this site that implements it, rather than asking you to take our word for it.

Frequently asked questions

How long should a password actually be?

16 characters is a reasonable baseline for most accounts today, longer for anything especially sensitive. Check the specific service's maximum length — some cap it lower than you'd like.

Do I still need numbers and symbols?

They still add some entropy and many services require them, but length is doing most of the work. Don't sacrifice length to cram in more symbol variety.

Is it OK to write my password down?

A password written on paper and kept somewhere physically secure is safer than a weak, memorized password reused everywhere. A password manager is a better long-term answer — see our breakdown of when that's worth setting up.