Most password advice is stuck in 2005: one uppercase, one number, one symbol, and you're done. But those rules produce passwords that are hard for humans to remember and easy for computers to crack. The math of how passwords actually get broken tells a different story.
Here's what really makes a password strong, and how to create and check yours for free.
Length beats complexity
Passwords are cracked by computers guessing billions of combinations per second. What defeats that is the sheer number of possibilities — and length adds possibilities far faster than symbols do. A short password full of `$` and `%` has fewer combinations than a long, plain one.
That's why a passphrase like `correct-horse-battery-staple` is stronger than `P@ss1!` — and much easier to remember. Aim for 16 characters or more; a memorable phrase of random words is ideal.
Uniqueness matters even more
The single biggest risk isn't a weak password — it's a reused one. When any site you use gets breached (and they do), attackers take that email-and-password pair and try it everywhere else. One reused password can unlock your email, bank and everything tied to them.
So: every account gets its own unique password. That's impossible to do from memory, which is exactly what a password manager is for — it remembers them so you don't have to.
Generate strong passwords instantly
Don't invent passwords in your head — humans are predictable. Use the free Password Generator to create long, random, unique passwords, generated in your browser and never sent anywhere.
Password GeneratorCreate strong, random passwords instantly.Test how strong yours is
Curious how a password holds up? The Password Strength Checker estimates its strength and roughly how long it would take to crack — a quick reality check. It runs entirely in your browser, so nothing you type is sent anywhere.
Password Strength CheckerEstimate how strong a password is.The short version
- Longer is stronger — aim for 16+ characters; a random passphrase is great.
- Never reuse a password across sites.
- Use a password manager so unique passwords are actually practical.
- Turn on two-factor authentication wherever you can — it protects you even if a password leaks.
- Don't rely on predictable tricks like `Password1!` or swapping `a` for `@`.
Two-factor authentication is the best single upgrade to your security. Even a perfect password can leak in a breach; 2FA means it isn't enough on its own.