Guide
How to create a strong password (and why length beats complexity)
Password strength is mostly about length and randomness. This guide explains generators, passphrases, and what sites actually check.
Updated 2026-08-17
What attackers actually try
Guessing a password is rarely someone sitting at a keyboard. Stolen lists, credential stuffing, and automated guessing against hashed dumps are the common paths. A password that is a slightly altered pet name loses against those lists. A long random string, or a long random passphrase, does not.
Complexity rules (one uppercase, one symbol) were meant to stop the pet-name problem. They often produce Passw0rd! instead. Length is the better control because each extra character multiplies the search space, and because a 20-character random string is still usable with a password manager.
Use a generator, then store the result
Human brains are bad entropy sources. A generator that draws from the browser’s cryptographic random API is a better source than keyboard mashing. Set a length the site allows (16 is a practical default; longer is better when accepted). Turn on mixed case and digits; add symbols if the site permits them without silently stripping them.
Copy the result into a password manager. Do not reuse it. Do not email it to yourself as “backup.” The generator on this site does not store the value — once you leave the page, it is gone unless you saved it.
Passphrases vs character soup
A diceware-style passphrase of several uncommon words can be both memorable and strong. Random characters win when you will never type the password by hand. Either approach beats a short “complex” password. What fails is a short phrase plus a year, or the same password with a suffix per site.
If a site still caps passwords at eight characters, that is the site’s failure, not yours. Use the maximum they allow, enable a second factor, and treat that account as weaker than the rest.
What not to do
Do not generate passwords on a shared computer and leave them in the clipboard. Do not paste them into a random “is my password hacked” field unless you understand that you are giving the password away. Checking whether an email appears in a known breach (without submitting the password) is a different, safer question.
A password generator is not encryption. It does not wrap your files. It only creates a secret you then protect with other habits: unique per site, stored in a manager, and preferably behind two-factor authentication.
Related tool: Password Generator