How to Create a Strong Password

July 22, 2026

Most password advice fixates on the wrong things — “use a capital letter and a symbol” — while ignoring the changes that actually protect an account. Here is what matters, in order of impact.

1. Length beats complexity

A password’s resistance to guessing is measured in entropy: the number of equally likely possibilities an attacker would have to try. Entropy grows with both the size of the character set and the length, but length is the cheaper, more powerful lever.

The long “simple” password is far stronger than the short “complex” one. Each extra character multiplies the search space; adding symbols only widens it a little. This is why passphrases — four or five random words — work: they reach high entropy while staying memorable. (They must be random. “I love my dog” has almost no entropy.)

For a password you will store in a manager and never type, skip memorability entirely and use 20+ fully random characters.

2. Every account gets its own password

The biggest real-world threat is not brute force against one strong password — it is credential stuffing. Attackers take username/password pairs leaked from one breached site and replay them, automatically, against hundreds of other sites. If you reuse a password, one company’s bad security day becomes a break-in everywhere you used it.

A unique password per site turns a breach into a single, contained problem. Check whether your addresses appear in known breaches at a service like Have I Been Pwned.

3. Use a password manager

You cannot remember 100 unique 20-character passwords, and you should not try. A password manager (1Password, Bitwarden, the one built into your browser or OS) generates them, stores them encrypted, and — importantly — only autofills them on the exact domain they belong to, which defeats most phishing pages. The single password you memorise is the vault’s, so make that one a long passphrase and protect it with two-factor authentication.

4. Turn on two-factor authentication (2FA)

Even a strong, unique password can leak through a breach, malware, or a convincing phishing page. A second factor means a stolen password alone is not enough:

• Best: a hardware security key (FIDO2/WebAuthn) or a passkey — phishing-resistant.
• Good: an authenticator app (TOTP codes) or push approval.
• Last resort: SMS codes. Better than nothing, but vulnerable to SIM-swapping, where an attacker ports your number. Use an app instead wherever it is offered.

Enable 2FA at least on your email, your password manager, your bank, and your main cloud and social accounts — email first, because it is the reset path for everything else.

5. Do not rotate passwords for no reason

Forcing a change every 90 days pushes people toward predictable patterns — Summer2026! becomes Autumn2026! becomes Winter2027! — which is easier to guess, not harder. Current guidance, including NIST’s, is to change a password only when there is evidence it was compromised (a breach notice, suspicious activity). Rotate the breached one immediately; leave the rest alone.

How long does a password actually last against cracking?

This assumes the attacker has stolen a database of hashed passwords and is guessing offline against a modern GPU rig (very roughly 100 billion to 1 trillion guesses per second for a fast hash like unsalted SHA-1; far slower for a proper password hash like bcrypt or Argon2, which is why sites should use those).

Two things this table hides: online guessing against a live login is far slower and rate-limited, so almost any non-reused password survives it; and if your password was in a breach, none of this matters, because the attacker already has it in plaintext. Length plus uniqueness is what covers both cases.

Passkeys: where this is heading

A passkey replaces the password entirely with a public/private key pair tied to the site and stored on your device (phone, laptop, or a hardware key), unlocked by your fingerprint, face, or device PIN. There is nothing to type, nothing to phish, and nothing to leak in a breach — the site only stores the public half. Where a site offers passkeys, use them; they are strictly better than a password plus 2FA. Password managers now sync passkeys across your devices the same way they sync passwords.

Storing recovery codes and the master password

• The password-manager master password is the one you must memorise. Make it a long passphrase you have never used anywhere else, and write it on paper stored somewhere physically secure (a safe, a sealed envelope with a trusted person) — losing it can mean losing everything in the vault.
• 2FA recovery codes (the one-time backup codes a site gives you when you enable 2FA) should be printed or saved in your password manager, not left in a screenshot in your camera roll.
• Do not rely on a single device. If your only 2FA method is an app on one phone and the phone is lost, you can be locked out. Register a second method (a hardware key, or the same TOTP secret on a backup device).

Common mistakes

• Personal info in the password — names, birthdays, pets, favourite team. All of it is public or guessable.
• Predictable substitutions — p@ssw0rd, l3tm3in. Cracking tools apply these automatically.
• Reusing a “strong” password across sites — strength does not help once it leaks.
• Storing passwords in a plain document or browser notes — use an encrypted manager.
• Security-question answers that are true — “mother’s maiden name” is findable. Treat them as extra passwords and store random answers in your manager.

The bottom line

Make passwords long (16+ random characters, or a 5-word random passphrase), unique per site, and stored in a password manager. Turn on app-based or hardware 2FA on your important accounts, starting with email. Only change a password when it is actually compromised. Generate one now with the password generator, which uses your browser’s cryptographic random source and transmits nothing — paste the result straight into your manager.