Most account break-ins do not involve clever hacking. They use passwords that were guessed, reused from another leaked site, or easy to crack. A strong password is cheap to make and makes the attacker's job much harder.

What makes a password strong

Three things matter, in this order:

  1. Unique. Use a different password for every account. If one site is breached and you reused the password, attackers try it on your email and bank next. This is called credential stuffing.
  2. Random. Humans are bad at being random. Substituting "@" for "a" or adding "1!" at the end is a pattern that cracking tools already try.
  3. Long. Each extra character multiplies the number of possible passwords.

Entropy in plain words

Entropy, measured in bits, describes how many guesses are needed. Every added bit doubles the number of possibilities. For a password chosen at random, the number of bits is the length multiplied by the bits per character.

  • A random digit has about 3.3 bits.
  • A random lower-case letter has about 4.7 bits.
  • A random character from letters, digits and about two dozen symbols has about 6.4 bits.

So a 10-character password using all kinds of characters has about 64 bits, and a 16-character one has about 103 bits. Because each added character adds the same amount, adding length is the easiest way to add strength. A 20-character password of only lower-case letters (about 94 bits) beats a 10-character one with symbols (about 64 bits).

These figures apply only to passwords that were really chosen at random. A password you made up, like a name and a year, is far weaker than its length suggests.

What to avoid

  • Names, birthdays, pet names, sports teams and keyboard patterns such as "qwerty".
  • Common words with small changes ("P@ssw0rd").
  • The same password with a number added for each site.
  • Passwords that are shared by email or chat.

Use a password manager

Nobody can remember dozens of long random passwords. A reputable password manager creates and stores them for you, and fills them in on the right site. You then remember only one strong main password, ideally a passphrase of several unrelated words. Many browsers and phones also include a built-in manager.

Add a second step

Turn on two-factor authentication where it is offered, especially for email, banking and any account that can reset others. Even if a password leaks, the second step blocks most attacks. An authenticator app or a hardware key is stronger than a text message code.

Is it safe to generate a password online?

It can be, if the page makes the password on your own device and never sends it anywhere. This tool creates passwords in your browser using the browser's cryptographic random generator, and it does not store or transmit them. Even so, use a device you trust, and copy the result into your password manager right away.

Try it

Choose a length (16 or more for important accounts), pick the characters your site allows and copy the result. If a site rejects some symbols, untick them and make the password a few characters longer instead.