How to create a strong password: length, randomness and the Password Generator

Most advice about passwords is a list of rules: use a capital letter, add a number, add a symbol, change it every few months. Those rules produce passwords like Summer2026! that feel strong and are not. What makes a password hard to guess is not how it looks, but how unpredictable it is and how long it is. This guide explains that in plain terms, shows the arithmetic, and then shows how to use the free Password Generator properly together with a password manager.

What "strong" really means

An attacker who steals a database of password hashes, or who tries guesses against a login form, wants to find your password by trying many candidates. The strength of a password is the number of guesses it would take, and that depends on how many equally likely possibilities there are.

If a password is chosen at random from a set of characters, you can calculate the number of possibilities. Each position multiplies the count by the size of the character set. Security people usually express the result in bits of entropy: the number of times you could double the possibilities. Each extra bit doubles the work for an attacker.

Here are some real figures:

Password type	Possibilities	Entropy
8 random lowercase letters	26 to the power 8	about 37.6 bits
12 random letters and digits (62 symbols)	62 to the power 12	about 71.5 bits
12 random characters from all 94 printable ASCII symbols	94 to the power 12	about 78.7 bits
16 random characters from a set of about 70 symbols	70 to the power 16	about 98 bits
16 random characters from all 94 printable ASCII symbols	94 to the power 16	about 104.9 bits

Notice that going from 12 to 16 characters adds far more strength than adding a symbol to the set. Length wins. Every extra character multiplies the number of possibilities, while widening the character set only changes the base.

For comparison with a human-made password: Summer2026! looks complicated, but an attacker's guessing software tries dictionary words, capitalised words, seasons, years and common endings long before it tries random strings. Its real entropy is a small fraction of what the 11 characters suggest.

Why predictable tricks do not help

People replace letters with look-alike symbols (a becomes @, o becomes 0), capitalise the first letter and add a number and an exclamation mark at the end. Attackers know all of these habits and build them into their tools. So P@ssw0rd1! is not much stronger than password.

Other predictable choices to avoid:

• Names, birthdays, phone numbers, pet names and sports teams, because they can be found about you online.
• Keyboard patterns such as qwerty or 1qaz2wsx.
• A base word with a changing number, such as Company-01, Company-02.
• Reusing a password with a small change from site to site.

Random is the point

A human cannot make a truly random choice. A computer can, if it uses the right source. The Password Generator uses your browser's cryptographic random source, which is designed for security, instead of the ordinary random function used for games and shuffling. Nothing is sent from your device to produce the password.

How to use the Password Generator

1. Open the Password Generator.
2. Set the length with the slider. Sixteen or more is a good default for most accounts. Use more for important ones such as email.
3. Choose which character types to include: lowercase, uppercase, numbers and symbols.
4. Press Generate, then Copy.
5. Paste it straight into a password manager or the sign-up form, and save it.

If a website rejects some symbols or limits the length, reduce the symbol set or the length and generate again. A website that limits passwords to a short length, or refuses certain characters, is showing you a weakness in how it stores passwords, and it is worth enabling extra protection on that account.

The part that matters more than the password: how you store it

A strong random password is impossible to remember, and that is the point. You are not supposed to remember it.

Use a password manager. A password manager creates, stores and fills in a different password for each site, and you only remember one strong master passphrase. Good ones are built into browsers and operating systems, or available as separate apps. For the master password, use a passphrase of several random words, which is long yet easier to remember.

Use a different password for every account. This is the single most valuable habit. When a website is breached, attackers try the stolen email and password combination on other sites. If every password is different, one breach stays one breach.

Turn on two-step verification for email, banking, social media and anything that can reset other accounts. A second step, such as an authenticator app or a hardware key, protects you even if a password leaks. Prefer an app or hardware key to text messages when you have the choice.

Protect your email first. Whoever controls your email can reset almost every other password. Give it the longest password and the strongest protection.

Passphrases: random words

When you need a password you can type from memory, such as a device login or a password manager's master password, use a passphrase: several words chosen at random from a large list, for example by rolling dice against a word list, not words you pick yourself. Four random words from a list of about 7,800 gives roughly 51 bits, and six words gives about 77 bits. Each word you add makes the phrase much harder to guess, and it is easier to remember than a string of symbols.

Quotes from songs, sayings or books are bad choices. They are not random, and attackers include famous phrases in their lists.

Common mistakes

Believing the site's strength meter. A meter that turns green for Password1! is checking rules, not guessability. Trust length and randomness.

Saving passwords in a plain note or a spreadsheet. If the file is stolen or shared by accident, every account is exposed. Use a manager, which encrypts the data.

Sharing a password in chat or email. Messages are stored and forwarded. If you must share access, use a feature built for it, such as a family or team vault in a manager.

Changing passwords on a fixed schedule for no reason. Modern guidance from standards bodies advises against forced regular changes without evidence of compromise, since people respond by making small, predictable edits. Change a password when you have reason to think it leaked, and change it to something new and random.

Ignoring breach notices. If a service tells you it was breached, change the password there, and anywhere else you reused it, immediately.

If you build a website

Never store passwords as plain text or with a plain fast hash. Use a slow, salted password hashing algorithm built for the job; the password hashing lesson in the PHP course shows how, and the web security lesson covers other common attacks. To understand what hashing is, and why it differs from encryption and encoding, read the guide to the Hash & Encode Toolkit.

Related tools

Need a unique identifier rather than a password, such as a key for a database record? Use the UUID Generator. To see what a hash of a value looks like, try the Hash & Encode Toolkit.

Quick answers

How long should my password be? At least 12 characters for ordinary accounts and 16 or more for important ones, generated randomly. For a master password, use a passphrase of five or six random words.

Are symbols required? Not for strength if the password is long and random. Include them if a site demands them.

Is it safe to use an online generator? Use one that creates the password on your device and does not send it anywhere, and still treat it as a convenience. A generator built into your password manager is a good alternative.

What if I forget my master password? Most managers cannot recover it, by design. Write it down once and keep that paper somewhere safe, not on your computer.