How to Create a Strong Password (Length Beats Complexity)

You get a notification that a service you signed up for in 2017 has been breached. You barely remember the account. Two days later, someone tries to log into your email — using a password you have also not changed since 2017.

Nobody guessed anything. They took a list from one break-in and tried it everywhere else. Understanding that this is how it actually works changes which password advice is worth following.

How passwords actually get broken

The mental image most people have — an attacker at a login page typing guesses — is almost never what happens. Login forms are slow, rate-limited, and lock out after a few failures. Two other methods do the real damage.

Credential stuffing. A company gets breached and its username-and-password list circulates. Attackers replay those pairs automatically against hundreds of other services. If you reused that password, those accounts are already open. Strength is irrelevant here — the password was not cracked, it was simply known.

Offline brute-force of leaked hashes. Services should store a hash of your password rather than the password itself. When a hash database leaks, an attacker can work on it with their own hardware and no rate limits at all, testing enormous numbers of candidates to see which produces a match. Our Hash Generator shows what a hash looks like.

Crucially, they do not start at aaaa. They start with leaked password lists, dictionaries, names, dates, and known human patterns, which is why “clever” substitutions fall so fast. The site’s hashing choice matters too — a fast hash like MD5 or SHA-256 is a poor fit for passwords, while a slow, purpose-built function such as bcrypt or Argon2 makes bulk guessing expensive. But that choice is the service’s, not yours, which is exactly why your own defence has to stand alone.

Why length is the dominant factor

Every character you add multiplies the number of possible passwords. Adding one does far more than swapping a letter for a symbol, because the effect is exponential rather than incremental.

This is why modern guidance — including from standards bodies such as NIST — has moved away from mandatory composition rules toward length plus a check against known-breached passwords. The old rules produce predictable results:

• “Must include an uppercase letter” → people capitalize the first letter.
• “Must include a number” → people append 1, or a birth year.
• “Must include a symbol” → people append !, or turn a into @.

You get P@ssw0rd1: compliant with every rule, and near the top of every cracking dictionary ever assembled. Hard for a human to remember, easy for software to find — exactly backwards.

A long password of ordinary characters beats a short one stuffed with symbols. Aim for at least 12 characters on everyday accounts, and more for anything protecting other things: email, your password manager, your bank.

Why random beats clever

People are terrible random number generators. Ask a hundred people for an “unpredictable” password and the answers cluster hard: keyboard runs, names, birthdays, the site’s own name with a suffix, one base word with a rotating number.

Attackers know this. Cracking tools include rule engines built to apply exactly those habits — capitalize, append digits, swap e for 3, add the year — to dictionary words at enormous scale.

Generated randomness has no pattern to exploit; nothing in the first half tells you anything about the second. The Password Generator lets you set length and character sets, producing passwords locally from your device’s cryptographic randomness. Nothing it generates is transmitted anywhere — which matters, since a password that travels over the network to reach you has already been somewhere it did not need to be.

Passphrases for the few you must type

Random strings are ideal for the passwords a manager types for you. But two or three you genuinely have to remember: your device login, and the manager’s master password.

For those a passphrase works better. Several unrelated random words strung together — something like harbor-lentil-quartz-drift — is long, easy to type on a phone, and far more memorable than an equivalent random string.

Two conditions make or break it:

• The words must be chosen randomly, not composed by you. A phrase you invented is one someone else could invent.
• Never use a quotation, lyric, or common saying. Anything printed anywhere is in a wordlist.

Reuse is the single worst habit

If you fix one thing, fix this one.

A unique password means a breach costs you one account. A reused password means a breach at the least competent service you ever signed up for hands over your email — and your email is the reset link for everything else.

Two variations that feel safer but are not:

• A base password with a site suffix (quartzdrift-netflix). Anyone seeing one leaked example guesses the rest instantly.
• A “tiered” system where low-value sites share a password. The tiers blur over time, and the forum you joined a decade ago is exactly the one that gets breached.

Password managers are the practical answer

You cannot memorize a hundred long random passwords. That is arithmetic, not a discipline failure — and it is what managers exist to solve.

A manager generates a unique random password per site, stores them encrypted, fills them in, and syncs across devices. It also quietly blocks phishing: it matches on the actual domain, so it will not offer your bank credentials to a lookalike site your eyes accepted.

The master password trade-off

The honest trade-off: you concentrate risk into one master password, so that one has to be excellent. Make it a long random passphrase, never reuse it, turn on two-factor for the manager itself, and keep the recovery kit somewhere physically safe. Done properly the trade favours you heavily — one very strong secret protecting many, instead of one mediocre secret shared across many.

Turn on two-factor authentication

Two-factor means a stolen password alone is not enough. After stopping reuse, it is the highest-value change you can make. Not all second factors are equal:

• Hardware security keys are strongest and resist phishing by design.
• Authenticator apps generating time-based codes are a solid, free choice for almost everyone.
• SMS codes are weakest — vulnerable to SIM-swap attacks and interception — but still far better than nothing. Use SMS if it is the only option, and upgrade when a better one appears.

What not to do

• Do not build passwords from personal information. Names, birthdays, pets, addresses — much of it is publicly discoverable.
• Do not use keyboard patterns like qwerty or 1qaz2wsx. They look random and live in every wordlist.
• Do not send passwords over chat or email. They persist in logs, backups, and other people’s devices indefinitely.
• Do not keep them in a plain text file or notes app synced unencrypted to the cloud.
• Do not rotate on a schedule for its own sake — it pushes people toward predictable increments. Change a password when there is a reason to.
• Do not confuse identifiers with secrets. A value from the UUID Generator is excellent for labelling records uniquely, but it is a name, not a credential.

Quick answers

How long should a password be? At least 12 characters ordinarily, and longer for email, banking, and your manager’s master password.

Are passphrases as safe as random strings? Yes, if the words are randomly chosen and there are enough of them. Length compensates for the smaller alphabet.

Do I need to change passwords regularly? No — only when a service is breached, when you suspect exposure, or when one is weak or reused.

Is a password manager safe? For nearly everyone, yes. The risk it removes is far larger than the risk it adds.

Is the “special character” rule useless? It adds a little, but far less than length. A rule that nudges people toward Password1! makes things worse.

The takeaway

Passwords fall to reuse and bulk offline guessing, not to someone typing at a login box. So the moves that matter are: make them long, make them random, make them unique per site, let a manager carry them, and turn on two-factor — starting with the accounts that can reset all the others.