Most people know they should use strong passwords. Few actually do. The gap between knowing and doing comes down to one thing: strong passwords are hard to create and even harder to remember. This guide closes that gap.
What Makes a Password Strong?
Password strength is fundamentally about entropy — the measure of unpredictability. An attacker trying to crack your password must guess from a search space. The larger and more random that search space, the stronger your password.
Two factors determine entropy: length and character set size.
- An 8-character password using lowercase letters only: 26⁸ ≈ 200 billion combinations
- A 16-character password using upper, lower, digits, and symbols: 95¹⁶ ≈ 4.4 × 10³¹ combinations
Modern GPUs can test billions of passwords per second. 200 billion sounds like a lot — it isn't. A single high-end GPU cracks it in under a minute. That 95¹⁶ number would take longer than the age of the universe.
The Rules That Actually Matter
1. Use at least 16 characters
NIST's 2024 guidelines recommend a minimum of 15 characters. We recommend 16–20 for anything important. Every additional character multiplies the search space exponentially.
2. Use a cryptographically secure random generator
Humans are terrible at randomness. We gravitate toward patterns, keyboard walks (qwerty123), and words that mean something to us. Attackers know this and use dictionaries, pattern rules, and keyboard-walk generators.
Use a tool that calls the operating system's cryptographically secure random number generator (CSPRNG) — the same source your OS uses for cryptographic keys. This site uses crypto.getRandomValues(), which is browser-native CSPRNG.
3. Use every character type
Uppercase, lowercase, digits, and symbols. Including symbols in a 16-character password increases the search space from ~10²⁸ to ~10³¹ — a 1,000× improvement.
4. Never reuse passwords
When a site is breached (and they all eventually are), attackers try stolen username/password pairs on every other major site. This is called credential stuffing. A unique password for every account means a breach at one site can't cascade to others.
The average person has 100+ accounts. You cannot remember 100 unique, strong passwords. This is why password managers exist.
What to Avoid
Avoid these common patterns that attackers specifically target:
- Personal information: birthdays, names of family members, pets, hometown
- Dictionary words with predictable substitutions:
P@ssw0rd,Tr0ub@dor - Keyboard patterns:
qwerty,123456,asdfgh - Repeating characters:
aaaa1111 - Short passwords: anything under 12 characters is vulnerable to brute force with modern hardware
- Sequential numbers:
password1,password2
The Alternative: Passphrases
A passphrase is a sequence of random words: correct-horse-battery-staple. Four random words from a dictionary of 7,776 gives approximately 51 bits of entropy — comparable to a 9-character fully random password, but far easier to remember.
Passphrases shine for passwords you need to type or memorize (laptop login, password manager master password). For everything else, use random character passwords stored in a manager.
Read more: Passphrase vs Password: Which Is More Secure?
The Only Practical System: Password Manager + Strong Master Password
Here's the system that actually works at scale:
- Pick a password manager: Bitwarden (free, open source), 1Password, or KeePass
- Create one strong master password: a 5-word passphrase you memorize and never write down
- Generate unique 20-character random passwords for every account using the manager's built-in generator
- Enable 2FA on your password manager and on every account that supports it
With this system, you memorize exactly one strong password. The manager handles the rest.
Enable Two-Factor Authentication (2FA)
A strong password alone isn't enough if a site's server is compromised (database breach reveals hashed passwords). 2FA adds a second factor an attacker would need physical access to steal.
Priority order for 2FA methods:
- Hardware security key (YubiKey) — phishing-resistant
- TOTP authenticator app (Google Authenticator, Authy) — good
- SMS — better than nothing, vulnerable to SIM swapping
Quick Reference: Strong Password Checklist
- ✓ 16+ characters
- ✓ Generated by a CSPRNG, not by you
- ✓ Uppercase + lowercase + digits + symbols
- ✓ Unique to this account (never reused)
- ✓ Stored in a password manager
- ✓ Account also protected by 2FA
If you tick all six boxes, your password is effectively uncrackable by any current or near-future technology.