Guide · 4 min read
How to Create a Strong Password
What actually makes passwords strong: length over complexity, unique-everywhere, managers over memory, plus 2FA that matters.
Last updated: 2026-10-07
Tools for this guide
The short answer
Generate a long, random, unique password for every account — 16+ characters — store them in a password manager, and turn on two-factor authentication everywhere it matters. Memorize exactly one strong secret: the manager's own master password.
The Password Generator builds cryptographically random passwords in your browser with your choice of length and character sets. Nothing is transmitted or stored, so generated secrets exist only where you save them.
Generate one in three steps
First, set the length to at least 16 and enable uppercase, lowercase, digits and symbols — maximum alphabet over maximum cleverness. If a site restricts symbols, length compensates: add four more characters.
Second, generate and copy the result straight into the site's password field and your manager in one motion. Never route a fresh password through notes apps, email or chat.
Third, enable two-factor authentication on the account immediately, before considering the job done. The password handles guessing; 2FA handles everything else.
Length beats complexity
Password strength is combinatorial: every character multiplies possibilities by the alphabet size, so length compounds exponentially while substitution tricks (!→i, 0→o) add almost nothing against modern guessing, which tries those variants first.
This is why a plain 20-character random string dwarfs an 8-character masterpiece — and why passphrases work at all. When a site caps length annoyingly short, max out every allowed character and lean harder on 2FA.
Managers over memory
Human memory holds a handful of secrets, so memorizers reuse — and reuse is the actual catastrophe, not weak construction. A manager remembers hundreds of unique random passwords so your brain doesn't have to.
Pick any reputable manager, import as you log in naturally over a week, and let it generate replacements for reused passwords one by one. The migration feels gradual; the security jump is immediate once duplicates start disappearing.
Device notes
On phones, use the manager's autofill rather than typing: mobile keyboards invite predictable simplifications, and shoulder-surfing is a real threat on transit. Biometric unlock keeps the manager itself both convenient and guarded.
On shared or work computers, never save passwords in the browser profile — sign into your manager, or better, use a portable session and sign out. Generated passwords in this tool vanish when the tab closes, which is exactly the behavior you want on hardware you don't own.
Frequently asked questions
How long should a password be?
Sixteen characters or more for anything important — length dominates strength because each added character multiplies the guessing space. A 20-character random password outclasses any 8-character puzzle, no matter how clever the substitutions.
Are phrases or random strings better?
Long random strings win on pure strength and work everywhere; four-plus-word passphrases win on memorability for the few passwords you must type. Use random strings from a generator for stored logins and reserve one strong memorized secret for the password manager itself.
Should I reuse passwords across sites?
Never. Breaches spill username-password pairs that attackers replay everywhere within hours. Unique-everywhere means one leaked database costs you one reset instead of every account you own.
Do I still need 2FA with strong passwords?
Yes — a second factor covers phishing and database theft that no password survives. Prefer authenticator apps or security keys over SMS codes, which can be intercepted. Strong password plus 2FA is the complete answer, not either alone.
Try it now — free, no signup
Strong passwords, zero trust required. Files stay on your device.
Open Password Generator