How to Create a Strong Password (What Actually Matters)
2026-08-04
The passwords people invent are far more predictable than they feel. Substituting a 3 for an e, appending a birth year, using a pet's name or a favourite team — cracking software tries all of these first, because everybody does them.
Step by step
- Open the Password Generator.
- Set the length. Sixteen characters minimum, twenty or more for anything important.
- Choose the character sets to include.
- Copy the password straight into your password manager.
Length matters more than symbols
This is the part most advice gets backwards. Adding one more character to a password multiplies the number of possible passwords by the size of the alphabet — roughly 70 times. Adding a symbol requirement to a short password multiplies it by far less. A twenty-character lowercase password is dramatically stronger than an eight-character one with a symbol and a number, and it is easier to handle.
Reading the entropy figure
Entropy measures how many guesses an attacker needs, in bits. Every extra bit doubles the work. As a rough scale:
- Under 55 bits — weak. Crackable by a determined attacker with commodity hardware.
- 75 bits — reasonable for most accounts.
- 100 bits or more — excellent, including against offline attacks on a leaked password database.
This is a far more useful signal than the coloured strength bars most sites show, which typically just count character classes.
The two rules that matter most
- Never reuse a password. One breach becomes every breach. This is the single biggest improvement most people can make.
- Use a password manager. Unique twenty-character passwords are only practical if something else remembers them.
Passwords here are generated with your browser's cryptographic random source, using rejection sampling so no character is more likely than another — a detail many generators get wrong. Nothing is transmitted, logged or stored, so the password exists only in your tab until you copy it.