Guide

How to create a strong password (and why length beats complexity)

Password strength is mostly about length and randomness. This guide explains generators, passphrases, and what sites actually check.

Updated 2026-08-17

What attackers actually try


Guessing a password is rarely someone sitting at a keyboard. Stolen lists, credential stuffing, and automated guessing against hashed dumps are the common paths. A password that is a slightly altered pet name loses against those lists. A long random string, or a long random passphrase, does not.

Complexity rules (one uppercase, one symbol) were meant to stop the pet-name problem. They often produce Passw0rd! instead. Length is the better control because each extra character multiplies the search space, and because a 20-character random string is still usable with a password manager.

Use a generator, then store the result


Human brains are bad entropy sources. A generator that draws from the browser’s cryptographic random API is a better source than keyboard mashing. Set a length the site allows (16 is a practical default; longer is better when accepted). Turn on mixed case and digits; add symbols if the site permits them without silently stripping them.

Copy the result into a password manager. Do not reuse it. Do not email it to yourself as “backup.” The generator on this site does not store the value — once you leave the page, it is gone unless you saved it.

Passphrases vs character soup


A diceware-style passphrase of several uncommon words can be both memorable and strong. Random characters win when you will never type the password by hand. Either approach beats a short “complex” password. What fails is a short phrase plus a year, or the same password with a suffix per site.

If a site still caps passwords at eight characters, that is the site’s failure, not yours. Use the maximum they allow, enable a second factor, and treat that account as weaker than the rest.

What not to do


Do not generate passwords on a shared computer and leave them in the clipboard. Do not paste them into a random “is my password hacked” field unless you understand that you are giving the password away. Checking whether an email appears in a known breach (without submitting the password) is a different, safer question.

A password generator is not encryption. It does not wrap your files. It only creates a secret you then protect with other habits: unique per site, stored in a manager, and preferably behind two-factor authentication.

Related tool: Password Generator

← All guides