How to Create a Strong Password
Last updated: September 2026
Most advice on how to create a strong password hasn't caught up with how attacks and defenses have actually changed. Here's what genuinely matters, in order of impact.
1. Length matters more than complexity
NIST's current digital identity guidelines (SP 800-63B) shifted away from mandatory complexity rules — forced special characters, mandatory capital letters — toward emphasizing length instead. A 16-character password of just lowercase letters can carry more entropy than a shorter password crammed with symbols. Aim for at least 16 characters where a service allows it.
2. Randomness beats anything you'd think of
Humans are bad at generating randomness. Even when we try to be unpredictable, we fall back on patterns — a real word, a capital letter at the start, a birth year at the end — and those patterns are exactly what cracking tools are built to try first. A password generated by a cryptographically secure random process avoids that entirely.
3. Never reuse a password across accounts
When one service is breached, attackers try the leaked username/password pairs against every other major site — a technique called credential stuffing. A strong, unique password everywhere means one breach doesn't cascade into every account you own.
Four ways to actually build one
Use a generator, not your head
The password generator on this site creates a cryptographically random password in your browser, with no manual pattern-guessing involved.
If you need to remember it, use a passphrase
Four or more unrelated random words is easier to recall than a random string, at comparable strength. Try Memorable mode.
If you need to type it manually and often, go pronounceable
A password that alternates consonants and vowels is faster to enter on a TV remote or game console. See the pronounceable generator.
Check the actual strength before you commit to it
Use the entropy calculator to see the real bit count behind any password you're considering — it's calculated locally, nothing is sent anywhere.
Frequently asked questions
How long should a password actually be?
16 characters is a reasonable baseline for most accounts today, longer for anything especially sensitive. Check the specific service's maximum length — some cap it lower than you'd like.
Do I still need numbers and symbols?
They still add some entropy and many services require them, but length is doing most of the work. Don't sacrifice length to cram in more symbol variety.
Is it OK to write my password down?
A password written on paper and kept somewhere physically secure is safer than a weak, memorized password reused everywhere. A password manager is a better long-term answer — see our breakdown of when that's worth setting up.