How to Create a Strong Password (and Actually Remember It)

Most account break-ins don't involve clever hacking. They happen because a password was short, predictable or reused on a site that later leaked its data. The good news is that a few simple habits make your accounts dramatically harder to break into.

What makes a password strong?

A strong password is long, random and unique. Those three properties matter far more than swapping an “a” for an “@”.

• Long: at least 12 characters, and 16 or more for important accounts.
• Random: not based on names, birthdays, keyboard patterns or dictionary words.
• Unique: never reused on another site.

Why length beats complexity

Every extra character multiplies the number of possible passwords. A random 16-character password drawn from upper- and lowercase letters, digits and symbols has around 10^31 possible combinations — far beyond what an attacker can try. Current guidance from security bodies such as NIST focuses on length and on blocking commonly used passwords, rather than forcing complicated character rules or regular password changes.

Generate one in a second

The Password Generator creates random passwords right in your browser. Choose the length and character types, and get a new password instantly. It uses your browser's cryptographically secure random number generator, and the password is never sent to our servers or stored anywhere.

If you need to read or type the password by hand — for Wi-Fi, for example — turn on “exclude look-alike characters” to avoid mixing up 0 and O, or 1, l and I.

How to remember them all

You don't. Nobody can remember dozens of long random passwords, and you don't need to:

• Use a password manager to store a unique password for every account.
• Memorize just one strong passphrase for the password manager itself — four or five random words work well.
• Turn on two-factor authentication for email, banking and social media.

Common mistakes to avoid

• Reusing the same password with a small variation (Password1, Password2…).
• Using personal details like names, birthdays or your favorite team.
• Sharing passwords over chat or email.
• Ignoring breach alerts: if a service you use has a data breach, change that password right away.