How to Create a Strong Password

Most advice about strong passwords focuses on the wrong thing. Forcing in a capital letter and a symbol because a website demands it doesn't make a password meaningfully harder to guess — length does. Here's what actually matters, in order.

1. Make it long before you make it complex

Every extra character multiplies the number of possible combinations an attacker has to search. Going from 8 to 16 characters does more for your security than adding symbols to an 8-character password ever will. Aim for at least 12 characters for anything ordinary, and 16 or more for anything sensitive — email, banking, your password manager's master password.

2. Use the full character set, but don't obsess over it

A mix of uppercase, lowercase, numbers and symbols does increase the pool of possible characters per position, which helps. But if a site limits you to letters and numbers, length still does most of the work. Don't sacrifice length to force in a symbol.

3. Avoid predictable patterns

Attackers don't just try random strings — they try patterns humans actually use. That includes:

• Dictionary words, even with substitutions like P@ssw0rd
• Keyboard walks like qwerty or 1qaz2wsx
• Personal details: names, birthdays, pet names, your street
• A single word followed by a year or a "!" — a very common and well-cracked pattern

These patterns feel random to the person typing them but are near the top of every password-cracking wordlist.

4. Never reuse passwords across sites

This is arguably more important than the password's strength. If one site is breached and you've reused that password elsewhere, attackers will try it everywhere else automatically — a technique called credential stuffing. A unique password per site means one breach stays contained to that one site.

5. Let a generator do it

Humans are bad at being random, even when we try. We favour certain letters, certain patterns, certain lengths. A cryptographically secure generator — one built on window.crypto.getRandomValues() rather than a simple pseudo-random function — removes that bias entirely and produces something no wordlist or pattern-matching attack will predict.

The practical takeaway

Long, random, unique, generated rather than invented, and stored in a password manager so you never have to remember it. That combination beats any mnemonic trick or personal formula, no matter how clever it feels.