How to Create a Strong Password (and Actually Remember It)
Weak and reused passwords are still one of the main ways accounts get taken over. The good news is that strong security does not require a perfect memory, only a few good habits. This guide explains what makes a password strong, how attackers actually guess passwords and a simple system to stay safe. To create one right now, use our free password generator.
How passwords get cracked
- Credential stuffing: when one website is breached, attackers try the leaked email and password combinations on other sites. Reusing a password turns one breach into many.
- Dictionary and pattern attacks: cracking software tries common words, names, dates and typical substitutions such as “@” for “a” and “0” for “o”, plus endings like “123” or “!”.
- Brute force: trying every combination. This only works on short passwords, because every extra character multiplies the work.
- Phishing: fake login pages that trick you into typing your password. No password is strong enough to survive being handed over.
What makes a password strong
A strong password is long, random and unique.
- Long: at least 12 characters, and 16 or more for important accounts. Length adds more security than any trick.
- Random: not based on words, names, dates or keyboard patterns like “qwerty”. Randomness defeats dictionary attacks.
- Unique: used on one account only, so a breach elsewhere cannot unlock it.
Examples of weak and strong passwords
| Password | Why |
|---|---|
| password123 | One of the most common passwords in every leak |
| Valhalla2026! | A word, a year and a symbol: a pattern crackers try early |
| Tr0ub4dor&3 | Looks complex, but it is a word with predictable substitutions |
| correct-horse-battery-staple | Four random words: long and much stronger, as long as the words are chosen at random |
| k7#Qm2!vRz9@Lp4x | 16 random characters of all types: very strong |
Random passwords vs. passphrases
Both are good choices. A random password of 16 or more characters is ideal for anything stored in a password manager, because you never need to type it from memory. A passphrase of four to six randomly chosen words is easier to remember and type, which makes it a good choice for the few passwords you must know by heart, such as your computer login or your password manager’s master password.
A simple system that works
- Install a reputable password manager on your phone and computer.
- Create one long passphrase as its master password and memorise it.
- Use the manager, or our password generator, to create a unique random password for every site.
- Turn on two-factor authentication (2FA) for email, banking, social media and the password manager itself. Authenticator apps or security keys are stronger than SMS codes.
- Start with your email account: whoever controls it can reset almost every other password.
Myths to forget
- “Change all passwords every month.” Current guidance, including from NIST, says to change them when there is a reason, such as a breach, not on a fixed schedule. Forced changes lead to weaker, predictable passwords.
- “Symbols make any password safe.” A short password with symbols is still weak. Length matters more.
- “Nobody wants my accounts.” Attacks are automated. Any account can be used for spam, scams or to reach your contacts.
What to do after a data breach
- Change the password of the affected account immediately.
- Change it on every other site where you used the same password.
- Turn on 2FA if you had not already.
- Watch for phishing emails that mention the breach; attackers use the news as bait.
Key takeaways
- Long, random and unique beats short and clever.
- Let a password manager remember your passwords.
- Protect your email and enable two-factor authentication.
Create a secure password now with the free password generator. Guidance on password policies: NIST SP 800-63B.