How to create a strong password you can actually use

Most advice about passwords — add a capital, a number and a symbol — produces passwords that are hard for people to remember and easy for computers to guess. Here is what actually makes a password strong.

How passwords get cracked

Attackers do not try random combinations first. They try the passwords people actually choose: common words, names, dates, keyboard runs like “qwerty”, and the predictable substitutions people use to meet the rules. “P@ssw0rd1!” ticks every box on a sign-up form and falls almost instantly, because it is a dictionary word with the most obvious changes.

It also helps to know where the guessing happens. Nobody sits typing guesses into a login page; sites lock accounts after a few failures. The real danger is a breach. When a site's database is stolen, the attacker gets a list of scrambled passwords and can test guesses against it on their own hardware, as fast as that hardware will go and with nothing to lock them out. A strong password is one that survives that.

Length beats complexity

Strength is measured in bits of entropy — the number of guesses an attacker needs, where every extra bit doubles the work. A random 16-character password drawn from letters, numbers and symbols has about 105 bits, far beyond brute force. Adding length adds far more than swapping a letter for a symbol. Aim for at least 16 characters for anything important.

The arithmetic is worth seeing once. Each random character adds a fixed number of bits, depending on how many characters it was picked from: about 4.7 bits from lower-case letters alone, about 6 from letters and digits, and about 6.6 from letters, digits and symbols. The last column below assumes an attacker testing 10 billion guesses a second against a stolen database:

Four more characters turned a week into a million years. No amount of clever punctuation in an eight-character password comes close to that. These figures apply only to passwords chosen at random — a password a person made up has far less entropy than its length suggests, because people are predictable.

Generate one step by step

1. Open the Password Generator.
2. Choose a random password or a word-based passphrase.
3. Set the length and the character types.
4. If you will type it by hand, exclude ambiguous characters — 0 and O, 1, l and I — so it cannot be misread.
5. Copy it straight into your password manager or the sign-up form.

Passwords are generated in your browser using its cryptographic random number generator, and nothing is sent or stored. Close the tab and it is gone.

When to use a passphrase

For the few passwords you have to type or remember — your computer login, your password manager's master password — a passphrase of random words is easier. Four random words from a large list give roughly 52 bits: weaker than a long random string, but far stronger than anything a person invents, and much easier to type on a phone. Five or six words is better still. The words must be chosen at random, not picked by you; a phrase from a song or film is guessable.

Each random word adds about 13 bits, so five words give roughly 65 bits and six about 78 — the same strength as a 12-character random password, in a form you can actually remember. For a master password that protects everything else, six words is a sensible choice.

Check a password you already use

The Password Strength Checker estimates how quickly a password could be guessed and names the patterns that weaken it — dictionary words, dates, keyboard runs. It runs on your device, so the password is never sent anywhere.

Keep in mind what it measures. It estimates how guessable a password is; it cannot know whether that password has already appeared in a breach, because checking would mean sending something to an outside service. A strong password that has leaked, or that you use on several sites, is still unsafe. Password managers and some browsers offer breach alerts, which cover that side.

The habits that matter more

• One password per site. When one site leaks its passwords, attackers try them everywhere else. A unique password contains the damage.
• Use a password manager. It remembers a different strong password for every account, so you only need one good passphrase.
• Turn on two-factor authentication for email, banking and anything that can reset your other accounts.

Your email account deserves the most care of all. Almost every other account can be reset by a message sent to it, so whoever controls your inbox controls the rest. Give it a long unique password and two-factor authentication before anything else.

What a strong password does not protect against

Phishing. If you type a perfect password into a fake login page, the attacker simply has a perfect password. Two things help here. A password manager fills in passwords only on the real site's address, so it will not offer your bank password on a look-alike page — take it as a warning when it does not fill. And two-factor authentication means a stolen password alone is not enough. Where a site offers passkeys, consider them: they are tied to the genuine site and cannot be typed into a fake one.

Old advice you can drop

• Changing passwords every few months. Current guidance from standards bodies such as the US National Institute of Standards and Technology is to change a password when there is reason to think it was exposed, not on a schedule. Forced changes push people towards predictable patterns such as adding a number to the end.
• Requiring a symbol and a capital. The same guidance favours length over mandatory character types.
• Never writing anything down. A master passphrase written on paper and kept somewhere safe at home is a reasonable backup. The threat to most people is a stranger on the internet, not someone searching their desk.
• Honest answers to security questions. A mother's maiden name or a first school can often be looked up. Treat these answers as extra passwords: give a random answer and store it in your password manager.