The average person has dozens of accounts, and the realistic choice isn't between a weak password and a perfect one — it's between approaches that work in practice. A method that produces strong passwords you can't remember doesn't help.
What Makes a Password Strong
Length is the most important factor. A 16-character password of random lowercase letters is more secure than an 8-character password with symbols, because length exponentially increases the number of possible combinations.
Unpredictability is the second factor. Substituting letters with symbols ("P@ssw0rd") is predictable — attackers' tools know all common substitutions and test them automatically.
Uniqueness per site means one breach doesn't expose all your accounts.
Method 1: Random Passphrase
Pick 4–6 random words and combine them:
staple-hammer-cloud-nineteen
- 28 characters — much stronger than most "complex" short passwords
- Easy to remember (you can form a mental image)
- No symbols required (length makes up for it)
The words must be genuinely random — not phrases from songs or favourite things that could be guessed.
Method 2: Let a Generator Do It
Use Password Generator to create a random password at any length and character set. For accounts where you use a password manager, generating a 20-character random string is the easiest approach — you never need to remember it.
Passwords to Avoid
| Pattern | Why it's weak |
|---|---|
Password123 | Dictionary word + predictable number |
P@ssw0rd! | Known substitution pattern |
| Your name + birth year | Publicly guessable |
123456 or qwerty | In every leaked password list |
| Same password everywhere | One breach exposes all accounts |
| Short regardless of complexity | Length beats complexity |
Checking Your Password
Password Strength Checker estimates how long a typical attack would take to crack a password. A strong password should take years or more at realistic attack speeds.
The Password Manager Solution
A password manager (Bitwarden, 1Password, Apple Keychain, Google Password Manager) generates a unique strong password for every site and fills it in automatically. You remember one master password; the manager handles everything else. This solves both the "strong" and "unique" requirements simultaneously.
Two-Factor Authentication as a Safety Net
Even with a strong password, 2FA (two-factor authentication) adds a critical second layer. With 2FA enabled, a stolen password isn't enough — the attacker also needs your phone or authentication app. Enable 2FA on your most important accounts: email (most critical, since it controls password resets for everything else), banking, and any account with payment information. Most services offer TOTP (time-based one-time passwords via apps like Google Authenticator or Authy) or SMS codes. TOTP apps are more secure than SMS for 2FA purposes.
