How to Create a Strong Password (Why Length Wins)

Attackers rarely type guesses by hand. They run software that tries billions of combinations per second against a stolen list, so the real question is how long that software would take to reach yours. The answer comes down mostly to one thing you can control: length. Everything else in this guide is about making that length count and keeping the result manageable.

What makes a password strong?

A password is strong when it is long, unpredictable, and used nowhere else. Those three properties work together. Length gives you a huge number of possible combinations, unpredictability stops an attacker from taking shortcuts, and uniqueness means one breach cannot unlock your other accounts. A password can be long and still weak if it is a famous quote, and it can be random but useless if you reuse it on ten sites.

Security researchers measure the first property with entropy, which is just a way of counting how many guesses a password represents. More possible combinations means more guesses, and more guesses means more time and cost for the attacker. You do not need to calculate entropy yourself. You only need to know the lever that moves it most, and that lever is length.

Why does length beat complexity?

Length wins because it multiplies the search space, while adding a symbol only shifts it. Each extra character multiplies the total number of possible passwords, so a longer password grows harder to crack far faster than a short one sprinkled with special characters. A five character password full of symbols still has very few combinations, so software churns through it in moments.

Here is the worked intuition. If you allow 26 lowercase letters, a 5 character password has 26 to the 5th power, or roughly 12 million combinations. A 16 character lowercase password has 26 to the 16th, which is about 43 sextillion, a number so large that adding a few symbols to the short one never closes the gap. That is why the four random words in the classic passphrase example below outrun a short jumble of punctuation.

This mirrors current official advice. The US National Institute of Standards and Technology now tells organisations to allow long passwords, drop forced periodic resets, and stop demanding a fixed recipe of uppercase, digits, and symbols, because those rules push people toward predictable patterns like Password1! rather than genuinely strong choices (NIST Special Publication 800-63B).

How do you build a passphrase you can remember?

Pick four or more unrelated words at random and string them together. The key word is unrelated. A phrase from a song, a movie, or a common saying is not random, because cracking tools feed on exactly those. Choose words that have no reason to sit next to each other, like anvil, mango, glacier, trumpet, and you get a passphrase that is long, memorable, and very hard to guess.

1. Choose four to six words with no logical connection to each other or to you.
2. Avoid famous quotes, lyrics, and anything tied to your name, job, or hobbies.
3. Add a number or symbol only if a site forces it, and place it somewhere you will recall.
4. Do not swap letters for lookalikes such as a to @ or o to zero, because tools already expect those.

Use a passphrase for the one password you truly must memorise, which is the master password for your password manager. Every other account can get a fully random string, because the manager remembers it for you. If you want the exact math behind why a few extra characters change the odds so dramatically, our guide on how to calculate percentages walks through the kind of multiplication at work here.

What mistakes undo a good password?

The most damaging mistakes are not weak characters but weak habits, and reuse is the worst of them. A perfect password becomes worthless the moment you use it on a site that gets breached, because attackers immediately try that pair on your email and bank. This is called credential stuffing, and it is why unique passwords matter more than clever ones.

• Reusing one password across sites, so a single breach unlocks many accounts at once.
• Using personal details like names, birthdays, or pet names that appear on your social media.
• Relying on predictable substitutions such as a for @ or o for zero, which cracking tools already test.
• Keeping default or dictionary words like password, admin, qwerty, or 123456.
• Adding a memorable but public suffix, such as the site name, so Netflix2026 becomes Amazon2026.

Two habits that matter more than the password itself

Two settings protect you even when a password leaks: uniqueness and a second factor. Together they contain the damage from any single breach, which is the realistic threat for most people rather than someone cracking a strong password character by character.

1. Use a unique password for every account, so one leaked site stays isolated and cannot cascade.
2. Turn on two factor authentication wherever it is offered, so a stolen password alone is not enough to log in.

You cannot memorise dozens of long, unique passwords, and you should not try. A password manager stores them safely, fills them in for you, and warns you when a saved password shows up in a known breach. You remember one strong master passphrase, and it handles the rest.

Are password generators safe to use?

A good in-browser generator is safe because it creates the password on your device and never sends it anywhere. The one below uses your browser secure random source, so the result is genuinely unpredictable rather than pseudo-random, and nothing about it is transmitted or logged. That combination of true randomness and local-only handling is exactly what you want.

Set the length to 16 or more, include the character types the site allows, and generate. The strongest realistic setup is a random 16 to 24 character password from a password generator for every account, kept in a manager, with two factor authentication switched on. You never see or memorise most of them, and that is the point.

Generate one, paste it into your password manager, and you never have to think about that account again.