A strong password is long, random, and uses a mix of character types
The core of a strong password is length and variety. Aim for at least 16 characters — longer is better. Mix uppercase letters, lowercase letters, numbers, and symbols. Avoid words from the dictionary, your name, your username, or anything someone could guess from your social media. A password like Tr0pic@lSunset2024 looks random but is actually weak because it follows a predictable pattern (capital letter, word, number). A password like 7mK#pL9$vQ2@xRw is stronger because there's no pattern to it.
The reason length matters more than you might think: a 12-character password with only lowercase letters can be cracked in hours by modern hardware. A 16-character password with mixed types takes vastly longer — the difference between days and centuries, depending on the attacker's resources. Every character you add multiplies the time needed.
Key Takeaways
- Use at least 16 characters mixing uppercase, lowercase, numbers, and symbols — no dictionary words or personal information.
- Avoid patterns like capitalizing the first letter, putting numbers at the end, or substituting numbers for letters (like "P@ssw0rd").
- Use a password manager to generate and store unique passwords for each account, so you only have to remember one strong master password.
- If you must create a password by hand, use a random method like picking words from a book and combining them with numbers and symbols.
- Never reuse the same password across multiple accounts, because a breach at one site puts all your accounts at risk.
Why random is better than memorable
Your brain is terrible at randomness. When you try to create a "random" password, you usually follow patterns you don't notice. You might capitalize the first letter, put numbers at the end, or swap a zero for an O. Attackers know these patterns and test them first. A password that feels random to you — like MyDog2024! — is actually one of the first things a cracking tool will try.
True randomness means no pattern at all. 9$mL2@kPx7#vR is harder to crack than Sunshine2024! even though the second one is easier to remember. This is why password managers exist: they generate genuinely random passwords and remember them for you, so you get both security and convenience.
How to generate a strong password without a password manager
If you need to create a password by hand, use a method that introduces real randomness. One approach: pick four random words from a book or dictionary, capitalize some letters randomly, and insert numbers and symbols between them. For example, if you pick "elephant," "bridge," "marble," and "kitchen," you might create ElePh@nt7bRiDge#mArble2KiTcHen. The words are memorable to you, but the capitalization and symbols are random enough to resist cracking.
Another method: use a dice roll or coin flip to decide which characters to capitalize and where to place numbers. This takes longer but produces a genuinely random result. The point is to avoid any pattern your brain naturally creates.
What makes a password weak, even if it's long
Length alone is not enough. A 20-character password that says ILoveMyDogMax2024!!! is still weak because it's based on words and a predictable pattern. Attackers use dictionaries of common phrases, names, and substitutions. They know people capitalize the first letter, add the current year, and use exclamation marks at the end.
Weak passwords also include personal information: your name, your partner's name, your pet's name, your birthday, your address, your username, or anything visible on your social media. Someone who knows you — or who finds your information online — can guess these. Even if you mix in numbers and symbols, the core is still guessable.
Passwords that reuse the same character type are also weak. A password of only lowercase letters, no matter how long, is easier to crack than a shorter password with mixed types. The variety of character types matters as much as the length.
Why you need a different password for each account
If you use the same password across multiple accounts and one website gets breached, attackers will try that password on your email, your bank, your social media, and everywhere else. This is called credential stuffing, and it's automated — attackers don't have to do the work themselves. A breach at a small site you barely remember can give attackers access to your most important accounts.
Using a unique password for each account means a breach at one site does not put your other accounts at risk. This is the main reason to use a password manager: it lets you have a unique, strong password for every account without having to remember dozens of different strings.
How password managers work and why they're safer than you think
A password manager is software that generates random passwords, stores them encrypted, and fills them in for you when you log in. You only have to remember one strong master password — the one that unlocks the manager itself. Popular options include Bitwarden (free and paid versions), 1Password, Dashlane, and LastPass. Most work across your phone, tablet, and computer.
The security concern people raise is: "If someone cracks my password manager, they get all my passwords." That's true, but it's still safer than reusing passwords. A password manager uses strong encryption, so cracking it is much harder than cracking a single account. And if your master password is strong — 16+ characters, random, mixed types — the manager is very difficult to break into. The risk of a breach at one of your accounts is much higher than the risk of someone breaking into your password manager.
Set up your password manager with a strong master password, then let it generate unique passwords for each account. You'll have better security and less to remember.
Testing whether your password is strong
You can check the strength of a password using online tools like How Secure Is My Password (howsecureismypassword.net) or Password Strength Checker (passwordstrengthchecker.com). These tools estimate how long it would take to crack your password using current hardware. They don't store your password — they run the calculation in your browser and discard it immediately.
Be aware that these tools can only estimate based on the password's length and character variety. They can't account for patterns or personal information that an attacker who knows you might try. But they give you a rough sense of whether your password is in the "hours to crack" range or the "centuries to crack" range.
A good rule of thumb: if the tool says your password would take less than a year to crack, make it longer or add more variety. If it says years or longer, you're in reasonable shape.
Frequently Asked Questions
Should I write my password down or save it somewhere?
No — not in a notebook, not in a text file on your computer, not in an email to yourself. The only exception is a password manager, which encrypts your passwords. If you must write something down temporarily, use a physical notebook you keep secure, and delete the note once you've memorized the password or set up your password manager.
Is it okay to use a passphrase instead of a random password?
Yes, if it's long enough and random enough. A passphrase like correct-horse-battery-staple (four random words with dashes) is actually quite strong because of its length, even though it's memorable. The key is that the words are truly random — not a phrase from a song or movie, and not words connected by meaning. A password manager can generate random passphrases too.
What if a website won't let me use special characters or requires a specific length?
Use the strongest password that website allows. If it caps you at 12 characters, use all 12 with mixed types. If it doesn't allow symbols, use uppercase, lowercase, and numbers. You're working within the site's constraints, not your own limitations. Still use a unique password for that account — don't reuse a password from another site just because this one is restrictive.
Do I need to change my password regularly if it's strong?
No. The old advice to change passwords every 90 days is outdated. If your password is strong and unique to that account, you only need to change it if there's been a breach at that site, you suspect someone has access, or you've shared it by accident. Changing a strong password frequently doesn't add security and often leads people to create weaker passwords they can remember.
What should I do if I think my password has been compromised?
Change it immediately on that account. If you reused the password elsewhere, change it on those accounts too. Check the site's security page or contact their support to see if there's been a reported breach. You can also check Have I Been Pwned (haveibeenpwned.com) to see if your email address appears in known breaches — this helps you know which accounts to prioritize.