How to Create a Strong Password

Quick answer: A strong password is long, randomly generated and used for one account only. The simplest way to create one is to let a cryptographically secure generator pick the characters and store the result in a password manager, so you never have to remember or reuse it.

What makes a password strong

Password strength comes from how hard a password is to guess. Attackers rarely type guesses by hand. They run automated tools that try leaked passwords, dictionary words, names, dates and common substitutions such as P@ssw0rd first, then work through every remaining combination.

Two things defeat this:

• Length. Every extra character multiplies the number of possible passwords by the size of the character set.
• Randomness. A password chosen by a person follows patterns, such as a capital letter at the start and a number at the end. A password chosen by a secure random generator has no pattern to exploit.

The third rule is uniqueness. When one website is breached, attackers try the same email and password on other services. A unique password for every account limits the damage to the account that leaked.

What NIST SP 800-63B recommends

The US National Institute of Standards and Technology publishes digital identity guidelines in NIST SP 800-63B. The current revision moves away from complex rules and towards length and screening:

• Passwords used as the only authentication factor should be at least 15 characters; passwords used with multi-factor authentication should be at least 8.
• Services should accept passwords of at least 64 characters and allow spaces and all printable characters.
• Services should not force composition rules such as "one uppercase, one number, one symbol".
• Services should not force periodic password changes, but must require a change when there is evidence of compromise.
• New passwords should be checked against lists of breached, common and expected values.

These rules are written for the services that store passwords, but they also tell you what to aim for: long, random and not previously exposed.

How to use the free Password Generator

The tool runs entirely in your browser and uses the Web Crypto API (crypto.getRandomValues) as its random source. The password is not sent to a server.

1. Open the Password Generator.
2. In Password length, enter a number from 8 to 128. The default is 24.
3. Choose the character sets with the Lowercase, Uppercase, Numbers and Symbols checkboxes. All four are selected by default. The symbol set is !@#$%^&*()-_=+[]{}.
4. Click Generate password. The result appears under Generated password and contains at least one character from each set you selected.
5. Click Copy result and paste the password straight into your password manager and the sign-up form.
6. Click Generate password again whenever you need a new one. Each click produces a fresh password.

If a website rejects certain symbols, untick Symbols and raise the length by a few characters to keep the same strength.

Worked example: measuring password strength

For a randomly generated password, strength is measured in bits of entropy: length multiplied by log2 of the character set size. Each extra bit doubles the number of possible passwords.

The full character set is 80 characters: 26 lowercase, 26 uppercase, 10 digits and 18 symbols. Notice that removing symbols at 24 characters costs far less than shortening the password. Length matters more than variety. These figures only apply to random passwords; a 24-character sentence you made up yourself is much weaker than the table suggests.

Common mistakes

• Reusing a strong password. A strong password used on ten sites becomes ten weak points once any of them is breached.
• Predictable changes. Turning Summer2025! into Summer2026! adds almost no protection, because cracking tools try these variations early.
• Personal information. Names, birthdays, pet names and phone numbers are easy to find and easy to guess.
• Storing passwords in plain text. A note on your desktop or an unencrypted spreadsheet exposes every account at once. Use a password manager.
• Skipping multi-factor authentication. A strong password does not stop phishing. Turn on an authenticator app or security key where the service supports it.

Storing and remembering passwords

You only need to remember a few passwords: your password manager's master password, your device login and possibly your main email account. For those, a long passphrase of several randomly chosen words is easier to type and remember than a string of symbols. Choose the words at random, for example with dice and a word list, rather than picking a phrase from memory.

Let the password manager generate or store everything else. Most managers fill passwords only on the matching website, which also helps you notice phishing pages.