How to Create Strong Passwords (and Actually Remember Them)
A practical guide to strong passwords: what makes them secure, common mistakes to avoid, and how to generate and remember them.
Weak passwords are still the easiest way for attackers to break into accounts. But "strong" doesn't have to mean "impossible to remember." Here's how to create passwords that are genuinely secure and practical.
What makes a password strong?
Two things matter most:
- Length — every extra character multiplies the number of guesses needed. Aim for at least 12-16 characters.
- Unpredictability — random beats clever. "P@ssw0rd!" looks complex but is in every attacker's dictionary.
You can test any password with the Password Strength Checker, which estimates how long it would take to crack.
The fastest way: generate them
The simplest strong password is a random one. Use the Password Generator to create a 16+ character password with letters, numbers, and symbols. Because it runs in your browser, nothing is ever sent over the internet.
The memorable way: passphrases
If you need a password you can actually type from memory — like your device login — use a passphrase: four or more random words strung together. Our Passphrase Generator creates ones like Table-Ferry-Copper-Wolf that are both easy to remember and very hard to crack.
Common mistakes to avoid
- Reusing passwords across sites — one breach then unlocks everything. Use a unique password per account.
- Small tweaks like adding "1" or "!" to an old password — attackers try these automatically.
- Personal info like birthdays, pet names, or your favorite team.
The bottom line
Generate a unique random password for every account with the Password Generator, use a passphrase for the few you must type by hand, and check anything you're unsure about with the strength checker. Store them in a reputable password manager and you're ahead of the vast majority of people online.