How to Create a Strong Password

Why “complex” isn’t the same as “strong”

Many people assume mixing in symbols and numbers — like P@ssw0rd1! — makes a password safe. But these substitutions (a→@, o→0) are already common patterns in attackers’ cracking dictionaries. They look novel to a human, but not to automated cracking tools.

What actually matters is unpredictability and length, not complexity for its own sake.

1. Length is your biggest lever

The time needed to brute-force a password grows exponentially with length. A 16-character password is thousands of times harder to crack than an 8-character one. A long, simple password can be far stronger than a short, complex one.

2. String together 4-5 unrelated words

Something like “cloud-bicycle-tuesday-coffee37” — unrelated words and numbers combined — is often called a passphrase. It’s easy to remember, but the sheer number of possible combinations makes it extremely hard to guess.

3. Never reuse a password across sites

If one site is breached, every other account using that same password becomes vulnerable too. This is called “credential stuffing” — attackers take leaked username/password pairs and try them against other sites. Using a unique password per site eliminates this entire attack vector.

4. Keep personal details out

Birthdays, names, pet names, or phone number fragments are often easy to guess from social media. Leave them out of your passwords entirely.

5. Use a password manager

Remembering dozens of long, unique passwords isn’t realistic. A password manager generates and securely stores a random strong password for every site, and fills it in automatically. The only thing you need to remember is one master password. See our guide on choosing a password manager.

6. Check what you’re already using

Creating new passwords matters, but it’s just as important to check whether a password you’re already using has shown up in a past breach. You can check that for free, safely, right in your browser, at PW Checkup.