How to Create a Strong Password (and Why Length Wins)

Most password advice is stuck in 2005: "use a capital letter, a number and a symbol." That guidance produces passwords that are hard for humans to remember and easy for computers to guess. Let's replace it with what actually works.

Strength = entropy, not complexity

The real measure of a password's strength is entropy — the number of equally likely possibilities an attacker would have to try. Entropy grows with both the size of the character set and, more powerfully, the length. A short password full of symbols can have less entropy than a long one of plain words, because length multiplies the search space far faster than swapping a couple of characters.

P@ssw0rd! looks complex but is one of the first things any cracker tries — it follows a predictable pattern. A longer, genuinely random string (or a string of random words) is exponentially harder to guess.

Why length wins

Each character you add multiplies the number of possible passwords. Going from 8 to 16 characters doesn't double the difficulty — it squares it. That's why modern guidance, including NIST's, prioritises length: aim for at least 16 characters for important accounts, more where you can.

• ~12 characters, mixed types ≈ 78 bits of entropy — fine for most accounts.
• ~16 characters ≈ 100+ bits — strong.
• 20+ characters ≈ 128+ bits — effectively unbreakable by brute force.

Passphrases: strong and memorable

A passphrase — several random words strung together, like correct horse battery staple — can be both very strong and easy to recall. The key word is random: words you choose yourself, or a famous quote, are predictable. Randomly selected words (e.g. via diceware) give real entropy. Passphrases shine for the few passwords you must memorise, like your device login or your password manager's master password.

The one rule that matters most: never reuse

Even a strong password is dangerous if you use it in more than one place. When any site is breached, attackers take the leaked email/password pairs and try them everywhere else — an attack called credential stuffing. A unique password per site means one breach can't cascade into your email, bank and work accounts.

Use a password manager

Nobody can remember hundreds of unique random passwords — and you shouldn't try. A password manager generates a strong, unique password for every site and stores them encrypted behind one master password (or passkey). You memorise exactly one strong passphrase; the manager handles the rest. This single habit eliminates reuse and weak passwords in one move.

Add MFA

Multi-factor authentication (MFA) requires a second factor — an app code or a hardware key — on top of your password. Even if a password is stolen or guessed, MFA usually stops the attacker. Enable it on your email, banking and any account that supports it; phishing-resistant hardware keys are the gold standard.

Put it into practice

Generate a strong, random password with our password generator, then see how it scores — and how much better it is than a "complex" short one — with the password strength checker. If you run IT for a team, codify these ideas with the password policy generator.