How to Create Strong Passwords and Manage Them
Updated November 2026
A strong password is one an attacker cannot guess, and the only reliable way to get one is to let a computer pick it at random. Much password advice still fusses over a capital letter here and a symbol there, while the real risks are short passwords, predictable patterns and the same password used on many sites. This guide explains what makes a password strong, how to measure it, and how to stay safe without memorising dozens of random strings.
How passwords are attacked
- Online guessing. Someone tries passwords in a login form. Rate limits and lockouts slow this down, so mainly very common passwords such as
123456orqwertyfall this way. - Offline cracking. When a site’s database is stolen, attackers get password hashes (scrambled versions of the passwords) and can test guesses on their own hardware as fast as it allows. This is where length and randomness matter most.
- Credential stuffing. Email and password pairs leaked from one site are tried automatically on others. No cracking is needed; it works only because people reuse passwords.
Phishing, a fake login page that tricks you into typing your password, is a fourth route, and no password is strong enough to stop it. That is one reason two-factor authentication and passkeys matter.
Length beats complexity
Every character you add multiplies the number of possible passwords by the size of the character set, while adding a character type only makes that set a little bigger. Eight random characters drawn from all 94 printable keyboard characters give about 6.1 × 10¹⁵ combinations; twelve random lowercase letters give about 9.5 × 10¹⁶, more than fifteen times as many, and they are far easier to type on a phone. Symbols still add strength, but if a site rejects some of them, making the password longer is the better trade.
Entropy, explained simply
Password strength is measured in bits of entropy. One bit is one coin flip: guessing a 40-bit password is as hard as calling 40 coin flips in a row. Each extra bit doubles the attacker’s work, so 50 bits is not 25% harder than 40 bits but about 1,000 times harder (2¹⁰ = 1,024).
For a password picked at random, entropy is simply length × log₂(number of possible characters):
| Character set | Size | Bits per character | 8 chars | 12 chars | 16 chars | 20 chars |
|---|---|---|---|---|---|---|
| Digits only (0–9) | 10 | 3.32 | 26.6 | 39.9 | 53.2 | 66.4 |
| Lowercase letters | 26 | 4.70 | 37.6 | 56.4 | 75.2 | 94.0 |
| Upper- and lowercase | 52 | 5.70 | 45.6 | 68.4 | 91.2 | 114.0 |
| Letters and digits | 62 | 5.95 | 47.6 | 71.5 | 95.3 | 119.1 |
| All printable ASCII | 94 | 6.55 | 52.4 | 78.7 | 104.9 | 131.1 |
To make that concrete, imagine an offline attacker testing ten billion guesses per second. That is a rough, illustrative figure for a fast hash on graphics cards; slow password hashes such as bcrypt or Argon2 cut it by many orders of magnitude. On average a random password is found after half of all possibilities have been tried:
| Random password | Entropy | Average time at 10 billion guesses/s |
|---|---|---|
| 8 lowercase letters | 37.6 bits | about 10 seconds |
| 8 characters, all types | 52.4 bits | about 3.5 days |
| 12 lowercase letters | 56.4 bits | about 55 days |
| 16 lowercase letters | 75.2 bits | about 69,000 years |
| 12 characters, all types | 78.7 bits | about 750,000 years |
| 16 characters, all types | 104.9 bits | thousands of times the age of the universe |
The caveat: these figures hold only for random passwords. Summer2026! has 11 characters and all four character types, so the formula says about 72 bits, but its word-year-symbol pattern is one that cracking tools try early. Human-chosen passwords are far weaker than the formula suggests, so meters that just count character types can mislead.
A reasonable target is 70–80 bits for ordinary accounts and 100 or more for the ones that unlock everything else, such as your email and password manager. The Password Generator shows the entropy of each password; its default of 16 characters with all four types comes to about 103 bits.
Passphrases: strong and memorable
For the few passwords you must remember, such as your computer login or your password manager’s master password, use a passphrase. Choose words at random from a large list, for example by rolling dice against a 7,776-word Diceware list. Each word adds about 12.9 bits: four words give 51.7 bits (too weak if a hash of it is ever stolen), five give 64.6, and six give 77.5, a good target for a master password.
Six words look like maple tundra spoon orbit velvet kettle (do not use this one; it is now published). A phrase you made up, a lyric or a famous quote is in every cracking dictionary. Capitals and separators add little; one more random word adds far more.
Use a password manager
Nobody can remember a hundred unique random passwords. A password manager keeps them in an encrypted vault behind one strong master password, fills them in and syncs them between devices. The managers built into browsers and phones are a good start; dedicated apps such as Bitwarden, 1Password or KeePassXC work across browsers and give you more control. As a bonus, a manager fills in a password only on the site it was saved for, so if it refuses to autofill on a page that looks like your bank, check the address: it may be a phishing site.
- Install a manager and make a six-word passphrase its master password. Keep a paper copy somewhere safe at home until you know it by heart.
- Turn on two-factor authentication for the manager itself.
- Change the accounts that matter most first (email, banking, your phone or cloud account, social media) to new random passwords of 16–20 characters.
- Replace the rest gradually as you log in to each site.
Two-factor authentication and passkeys
Two-factor authentication (2FA) asks for something besides your password, so a stolen password alone is not enough. Second factors differ in strength:
| Method | How it works | Weak points |
|---|---|---|
| SMS or email code | A one-time code is sent to your phone or inbox | SMS can be hijacked through SIM-swap fraud, and codes can be phished |
| Authenticator app | An app shows a six-digit code that changes every 30 seconds | Works offline, but you can still be tricked into typing a code into a fake site |
| Security key or passkey | Public-key cryptography tied to the real website’s domain | Resists phishing, because the browser will not use it on a look-alike domain |
Passkeys replace the password altogether. Your device creates a key pair: the website stores only the public key, while the private key stays on your device or in your password manager, unlocked with your fingerprint, face or screen lock. There is nothing to reuse, nothing on the server that lets a thief sign in, and nothing to type into a fake page. Where a service offers passkeys, they are usually the safest choice. Whatever you use, save the recovery codes a site shows when you turn on 2FA, so that losing your phone does not lock you out.
Reuse and breaches
Reuse is the biggest single risk for most people: when one site is breached, every account sharing that password is exposed to credential stuffing.
Services such as Have I Been Pwned show whether your email address appears in known breaches. Their password check uses a technique called k-anonymity: the password is hashed with SHA-1 in your browser and only the first five characters of the hash are sent. The SHA-1 hash of password begins 5BAA61E4C9B9…; only 5BAA6 leaves your device, and the service returns every leaked hash with that prefix for a local comparison. You can watch hashes change with the Hash Generator, using test strings rather than real passwords. Well-built sites store passwords with slow algorithms such as bcrypt or Argon2, not plain SHA-256, but you cannot see how a site does it, so use a unique password everywhere.
If a password was exposed, change it on that site and anywhere you used the same or a similar one, sign out other sessions, and turn on 2FA.
What not to do
- Do not build passwords from names, birthdays, pets, phone numbers or your username.
- Do not rely on substitutions: to a cracking tool,
P@ssw0rdis just “password”. - Do not use keyboard patterns such as
1q2w3e4r, or a base word with a number you increase at every forced change. - Do not keep passwords in a plain note, a spreadsheet or an email to yourself, or send them over chat; use your manager’s sharing feature instead.
- Do not answer security questions truthfully if the answer can be found online. Store a random answer in your manager.
- Do not use an identifier as a secret. The UUID Generator is ideal for unique IDs, but IDs end up in URLs and logs, and a version 7 UUID begins with a timestamp.
- Do not change good passwords on a schedule for its own sake. Forced changes produce predictable variations, and US NIST guidance (SP 800-63B) advises services not to require them. Change a password when there is a reason, such as a breach.
Related tools
- Password Generator – random passwords from your browser’s secure random generator, with an entropy estimate.
- Hash Generator – see how MD5, SHA-1 and SHA-256 turn text into fixed-length fingerprints.
- UUID Generator – unique identifiers for databases and test data, not for passwords.