A password is still the most common lock protecting your accounts, your money and your privacy. Yet most people use short, reused or easily guessed passwords. In this guide we will show you what a truly strong password looks like, why length matters more than complexity, and how to make your life easier with a password manager. If you do not feel like inventing passwords by hand, use our free password generator, which runs right in your browser.

Why length matters more than complexity

For years we were told that a good password needs uppercase and lowercase letters, digits and special characters. That is true, but length matters far more. Attackers do not guess passwords by hand. They try millions of combinations per second using powerful computers, and every extra character multiplies the number of possible combinations.

A short password like “Dog123!” can be cracked in a few seconds, even though it contains an uppercase letter, digits and an exclamation mark. An 18-character password, on the other hand, is almost impossible to break even if it uses only lowercase letters. So focus on length first: the minimum is 12 characters and the ideal is 16 or more.

What a strong password looks like

A strong password is long, random and unique. Random means it is not based on any word, name or pattern a machine could guess. Unique means you use it on one single account only.

An example of a weak password: “Joseph1985”. It contains a name and a year of birth, both of which are easy to find. An example of a strong password: “k7$Vm2pQ!zR9wXn4”. No one will remember a password like this, and that is fine, because you do not have to. That is exactly why password managers and generators exist.

What a passphrase is

If you need a password you can genuinely remember, use a passphrase. It is a combination of several random words, for example “brick-cloud-fork-moon-23”. Such a phrase has many characters, so it is very strong, yet it is easier to remember than a jumble of random characters.

The key is that the words are truly random and do not form a meaningful sentence. “I am going home to sleep” is not a strong phrase. Four or five genuinely random words give you a combination that not even a supercomputer can break. A passphrase is an ideal choice for the master password of your password manager, the one you must know by heart.

Why use a password manager

No one can remember dozens of unique strong passwords. The solution is a password manager, an app that securely remembers all your logins for you. You only remember a single master password and the manager takes care of the rest.

A password manager has other benefits too. It can fill in login forms automatically, warn you if one of your passwords appears in a data breach, and help you generate new strong passwords every time you sign up. Thanks to it, you can have a different password for every account without having to remember anything.

What you should never do with passwords

Even the best password becomes pointless if you make basic mistakes. So avoid these habits:

  • Do not use the same password on multiple accounts. If it leaks from one service, an attacker will try the same password everywhere else.
  • Do not use names, dates of birth, your children’s names or your pets’ names in a password. This information is easy to find on social media.
  • Do not use common words or sequences like “password123” or “qwerty”. They are in every attacker’s dictionary.
  • Do not send passwords over ordinary email or chat. If you must share a password, use a safer method, for example send a password securely.

Turn on two-factor authentication

Even a strong password can leak under certain circumstances, for example through phishing or a data breach at a service. That is why you should enable two-factor authentication (2FA) on your important accounts. It adds a second step to your password, most often a one-time code from a mobile app.

Thanks to 2FA, an attacker cannot get into your account even if they know your password, because they do not have access to the second factor. Enable it especially for your email, online banking and social media accounts.

How to use our password generator

The simplest way to a strong password is to have one generated for you. Our password generator runs entirely in your browser and uses a cryptographically secure source of randomness, so no password ever leaves your device.

Just set the length you want and the character types you want to use. The tool immediately shows you the password strength and the estimated time needed to crack it, so you can see at a glance how safe it is. If you need several passwords at once, for example for a whole team or multiple accounts, you can generate them with a single click. Then save the generated password in your password manager and you are done.

And if you want your account security sorted out end to end, from a password manager to two-factor authentication, we are happy to help.

This article is part of our Cybersecurity overview.